Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
168s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
windows7_x64
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
General
-
Target
1_cr.exe
-
Size
847KB
-
MD5
af067a53dcecb2f527a351a6491c56b9
-
SHA1
845f59d0324b2577979b51a8e66689f6f604ecde
-
SHA256
9cc9a90e31f1486a991360c25209f1b08aec5bd7e084de748e73ebef6deca38d
-
SHA512
e9cc332f2108be20acbdafe91a6ee8d489eddb05b752a05d5372a468ea6c95215ca06fb0881b49fc20fac9f0d602a665272b70997df4414ea98a016f60e4fd71
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe 836 1_cr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 836 wrote to memory of 1984 836 1_cr.exe 31 PID 836 wrote to memory of 1984 836 1_cr.exe 31 PID 836 wrote to memory of 1984 836 1_cr.exe 31 PID 836 wrote to memory of 1984 836 1_cr.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\1_cr.exe"C:\Users\Admin\AppData\Local\Temp\1_cr.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass C:\Users\Admin\AppData\Local\Temp\mByZgmXsR.ps12⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984
-