Overview
overview
3Static
static
923f0f8a50...a1.vhd
windows7-x64
3923f0f8a50...a1.vhd
windows10-2004-x64
3out.vhd
windows7-x64
1out.vhd
windows10-2004-x64
1$RECYCLE.B...op.ini
windows7-x64
1$RECYCLE.B...op.ini
windows10-2004-x64
1AdFind.exe
windows7-x64
1AdFind.exe
windows10-2004-x64
1System Vol...meGuid
windows7-x64
1System Vol...meGuid
windows10-2004-x64
1System Vol...gs.dat
windows7-x64
3System Vol...gs.dat
windows10-2004-x64
3Static task
static1
Behavioral task
behavioral1
Sample
923f0f8a50fd980789625fa96abff0707a233e75ef83c31b863781d216d743a1.vhd
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
923f0f8a50fd980789625fa96abff0707a233e75ef83c31b863781d216d743a1.vhd
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
out.vhd
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
out.vhd
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
$RECYCLE.BIN/S-1-5-21-1260530178-3479854673-1021568482-500/desktop.ini
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
$RECYCLE.BIN/S-1-5-21-1260530178-3479854673-1021568482-500/desktop.ini
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
AdFind.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
AdFind.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
System Volume Information/IndexerVolumeGuid
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
System Volume Information/IndexerVolumeGuid
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
System Volume Information/WPSettings.dat
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
System Volume Information/WPSettings.dat
Resource
win10v2004-20221111-en
General
-
Target
923f0f8a50fd980789625fa96abff0707a233e75ef83c31b863781d216d743a1.vhd
-
Size
13.0MB
-
MD5
08c14dd68da6800a6e630b0e6bee8f6f
-
SHA1
0ee8989e63070dc4bd54bc09189477234344fc8a
-
SHA256
923f0f8a50fd980789625fa96abff0707a233e75ef83c31b863781d216d743a1
-
SHA512
c2199feeb4e72524e030c36f051d1dcc13b90a278d722d35979c5c98fffee19a4de1d804de4fbe42476faa62b8b7818f0843eaa79415cef7c2805d4706672837
-
SSDEEP
49152:Hb//8/N+FV3giuequoTWmyjegvtYSN2NYwsmeMcx:bWN29gDeqzHCtYS
Malware Config
Signatures
Files
-
923f0f8a50fd980789625fa96abff0707a233e75ef83c31b863781d216d743a1.vhd.vhd
-
out.vhd.vhd
-
$RECYCLE.BIN/S-1-5-21-1260530178-3479854673-1021568482-500/desktop.ini
-
AdFind.exe.exe windows x86
12ce1c0f3f5837ecc18a3782408fa975
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
crypt32
CertNameToStrA
CertFreeCertificateContext
CryptDecodeObjectEx
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
advapi32
ConvertStringSidToSidA
ConvertSecurityDescriptorToStringSecurityDescriptorA
LsaLookupSids
ConvertSidToStringSidA
ConvertStringSidToSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
LsaOpenPolicy
GetLengthSid
LookupAccountSidA
IsValidSecurityDescriptor
IsValidSid
wldap32
ord309
ord215
ord139
ord132
ord12
ord178
ord77
ord141
ord207
ord96
ord146
ord223
ord310
ord41
ord135
ord72
ord304
ord191
ord14
ord147
ord166
ord79
ord36
ord27
ord121
ord13
ord54
ord55
ord205
ord26
ord117
ord119
ord126
ord301
ord93
ord196
ord218
ws2_32
ntohs
kernel32
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadFile
ReadConsoleW
ReadConsoleInputW
SetConsoleMode
CreateFileW
GetConsoleMode
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
HeapFree
HeapAlloc
SetFilePointerEx
GetFileSizeEx
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameW
GetConsoleCP
GetModuleHandleExW
ExitProcess
LoadLibraryExW
RaiseException
RtlUnwind
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesExA
lstrlenW
GetStdHandle
MultiByteToWideChar
FormatMessageW
GetTimeZoneInformation
LocalFileTimeToFileTime
GetLastError
GetFileAttributesA
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFree
SystemTimeToFileTime
WideCharToMultiByte
GetFileType
CreateDirectoryA
GetSystemTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
FreeLibrary
LoadLibraryA
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
CloseHandle
SetEvent
ResetEvent
ole32
CLSIDFromString
StringFromGUID2
user32
LoadStringA
Sections
.text Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
System Volume Information/IndexerVolumeGuid
-
System Volume Information/WPSettings.dat