Overview
overview
10Static
static
81.rar
windows7-x64
31.rar
windows10-2004-x64
3Ehhbsuuemv.exe
windows7-x64
10Ehhbsuuemv.exe
windows10-2004-x64
10GjIEmKW.exe
windows7-x64
10GjIEmKW.exe
windows10-2004-x64
10Jtvcsfni.exe
windows7-x64
10Jtvcsfni.exe
windows10-2004-x64
10OriginalBuild.exe
windows7-x64
1OriginalBuild.exe
windows10-2004-x64
8PUMPED_docc.exe
windows7-x64
10PUMPED_docc.exe
windows10-2004-x64
10Servicing-...te.pdf
windows7-x64
1Servicing-...te.pdf
windows10-2004-x64
1cgu3.rar
windows7-x64
3cgu3.rar
windows10-2004-x64
3debt.rtf.rar
windows7-x64
3debt.rtf.rar
windows10-2004-x64
3eeee.dotm
windows7-x64
1eeee.dotm
windows10-2004-x64
1egor.dotm
windows7-x64
10egor.dotm
windows10-2004-x64
10errr.dotm
windows7-x64
1errr.dotm
windows10-2004-x64
1example.dotm
windows7-x64
10example.dotm
windows10-2004-x64
10fasfs.dotm
windows7-x64
10fasfs.dotm
windows10-2004-x64
10ferrr.dotm
windows7-x64
1ferrr.dotm
windows10-2004-x64
1fffffffnew.dotm
windows7-x64
10fffffffnew.dotm
windows10-2004-x64
10Analysis
-
max time kernel
136s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2023, 18:36
Behavioral task
behavioral1
Sample
1.rar
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
Ehhbsuuemv.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
Ehhbsuuemv.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
GjIEmKW.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GjIEmKW.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Jtvcsfni.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Jtvcsfni.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
OriginalBuild.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
OriginalBuild.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
PUMPED_docc.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
PUMPED_docc.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
Servicing-invoice-template.pdf
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
Servicing-invoice-template.pdf
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
cgu3.rar
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
cgu3.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
debt.rtf.rar
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
debt.rtf.rar
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
eeee.dotm
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
eeee.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
egor.dotm
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
egor.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
errr.dotm
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
errr.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
example.dotm
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
example.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
fasfs.dotm
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
fasfs.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
ferrr.dotm
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
ferrr.dotm
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
fffffffnew.dotm
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
fffffffnew.dotm
Resource
win10v2004-20230220-en
General
-
Target
1.rar
-
Size
69B
-
MD5
67bc65619826de9a70b6bf52757ee6bc
-
SHA1
c9969e9aa039e2a50eeb10ae754b26bc0ef55ad1
-
SHA256
8d12f9138517957756f2b5745033708b2bd5d7129de8f0f1a01c1a9699d533fc
-
SHA512
ee6ec699db6dfe2b00dfa45cb71ec72971b1ed85c80c530975621dd4bd7f8f44f57b2073eb68235cf98ed48b1d22f925e6e1f16008e7f86d196dfa9ea7642567
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4232 OpenWith.exe