Overview
overview
7Static
static
7109CommandLib.dll
windows7-x64
1109CommandLib.dll
windows10-2004-x64
1HDSEvtMsg.dll
windows7-x64
1HDSEvtMsg.dll
windows10-2004-x64
1HDSentinel.exe
windows7-x64
7HDSentinel.exe
windows10-2004-x64
1HDSentinelTray.exe
windows7-x64
7HDSentinelTray.exe
windows10-2004-x64
7Storagetest.exe
windows7-x64
7Storagetest.exe
windows10-2004-x64
7afaapi.dll
windows7-x64
1afaapi.dll
windows10-2004-x64
1bc_vbdll.dll
windows7-x64
7bc_vbdll.dll
windows10-2004-x64
7de.chm
windows7-x64
1de.chm
windows10-2004-x64
1deta.exe
windows7-x64
7deta.exe
windows10-2004-x64
7deta1.exe
windows7-x64
7deta1.exe
windows10-2004-x64
7detat.exe
windows7-x64
1detat.exe
windows10-2004-x64
1detect.exe
windows7-x64
7detect.exe
windows10-2004-x64
7dethp.exe
windows7-x64
7dethp.exe
windows10-2004-x64
7dethp2.exe
windows7-x64
1dethp2.exe
windows10-2004-x64
1dethpt.exe
windows7-x64
7dethpt.exe
windows10-2004-x64
7detjm.exe
windows7-x64
1detjm.exe
windows10-2004-x64
1Analysis
-
max time kernel
240s -
max time network
319s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 08:42
Behavioral task
behavioral1
Sample
109CommandLib.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
109CommandLib.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
HDSEvtMsg.dll
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
HDSEvtMsg.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
HDSentinel.exe
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
HDSentinel.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
HDSentinelTray.exe
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
HDSentinelTray.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
Storagetest.exe
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
Storagetest.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
afaapi.dll
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
afaapi.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
bc_vbdll.dll
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
bc_vbdll.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
de.chm
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
de.chm
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
deta.exe
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
deta.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
deta1.exe
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
deta1.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
detat.exe
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
detat.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
detect.exe
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
detect.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
dethp.exe
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
dethp.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
dethp2.exe
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
dethp2.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
dethpt.exe
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
dethpt.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
detjm.exe
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
detjm.exe
Resource
win10v2004-20230915-en
General
-
Target
Storagetest.exe
-
Size
1.2MB
-
MD5
cc8e52e5c673f9e23838533bb17e80c6
-
SHA1
697e90fdd000ee34b3beaeec2250be2ce1844325
-
SHA256
b9ce5e851ec8fb1c086c0006f3cc257c152101ffc477a64f02713f7f0891eed2
-
SHA512
2659e2163ddd657f58334631d462c0ffca72522d270f95ef6115dd8f6123f82192149effa3fbd7f6768b7a1a32dcdea0698e4403c528cb3bbbf3570bd088b71a
-
SSDEEP
24576:aXrirwD+65FFYImeGA9M2Mmg6P49Iou1skEpNfQ4Cx:oryqFFYTAW2hgtusbp98x
Malware Config
Signatures
-
resource yara_rule behavioral9/memory/2772-0-0x0000000000400000-0x0000000003560000-memory.dmp upx behavioral9/memory/2772-1-0x0000000000400000-0x0000000003560000-memory.dmp upx behavioral9/memory/2772-3-0x0000000000400000-0x0000000003560000-memory.dmp upx behavioral9/memory/2772-4-0x0000000000400000-0x0000000003560000-memory.dmp upx behavioral9/memory/2772-5-0x0000000000400000-0x0000000003560000-memory.dmp upx -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 Storagetest.exe