Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 15:07
Static task
static1
Behavioral task
behavioral1
Sample
77e2c26553905fe3dea8deb624b6fa2c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77e2c26553905fe3dea8deb624b6fa2c.exe
Resource
win10v2004-20231222-en
General
-
Target
77e2c26553905fe3dea8deb624b6fa2c.exe
-
Size
73KB
-
MD5
77e2c26553905fe3dea8deb624b6fa2c
-
SHA1
85bfc36d57c2ff7c2a8c7c5fda959d27039f91c7
-
SHA256
45f209e5cbc511d9f2be44b9a23ed4251358927f5cbb186c6191ac649ca1e845
-
SHA512
253dcd33139ca6c156b15277ab8be11269662435e853dd529bdccba97475a5499fbd9d0fcd314aa734ceef837a33aea597895e2821f18773ec9b0548f49c5464
-
SSDEEP
768:UYXA5GjhpM7h/KEx/IM2+RVPdFfhbGl9O92G33H9wP/YLjb06v1x:UqAIm/BRFdFfhCl9OMG33H2P/Yb3v1x
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3K9X24S-1FN8-0E56-8D6U-11S9043784LW} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BG4YAIRV-93KR-9L59-95T8-2E5622R9F3L7} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{TBK5S114-6FI6-6G45-0X23-9ZKR90ENXC3J} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T2HK8B1K-ZWM4-60K4-V93L-912M6Y14TD44} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{DCPP12KX-136V-EL4T-EDQQ-72LOUJ6WV04U} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{61J5V03Q-Q933-W8KM-6145-804SR0L4X90N} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{K5W046C9-4U83-LN62-L691-4TS0M4Y9MO72} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{1GQAF4MZ-GETY-Y3P8-Z5M8-0H7VD45U124T} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{UA22709O-7DEK-673G-QW0N-PXGKO90G5BE5} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{I770HJX8-24R1-2589-1OP8-D6TDCS9ZL3RV} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{ZFJRXG48-F2P6-D27X-AGLS-YH5982R7E33Z} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{Z5S1136U-H268-B55X-23OY-92N0DNMC3JW7} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{MSA1GPZE-4LY2-1S82-IP89-4L80G7UCK5T1} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{10JT0C4O-9CP7-8125-71KU-1D5P01Q89136} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FJ5ZZG5A-15M0-I38T-C2V8-24UWA37YE260} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{I6R0D5R1-3478-137Z-J2S0-E6TU4579247A} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4Q9DMT1A-M8YJ-45TG-5RYE-N77C5M9Z56UI} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{MA935U23-6912-RS9G-7WGF-K6C14UYNN9F4} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{YW4Q0025-RFE5-7Z45-U12M-W81L9BK3Z2HT} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{7FH5XB26-032S-8157-A05V-73N591MOC0LQ} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{6B0N56D3-L625-7RY3-6R0O-O7EJM7217S93} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{U9038E33-PZ3J-7223-V013-984JQB3K7W24} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1HRBG4N-A32U-93KQ-905N-80I7WD46V224} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5QYGKP90-H5BE-55DJ-38U1-288HNU9AKTZ1} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{046ZBP59-DJV8-15R8-GHNV-34UUZ2RT0JNC} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{LU00J8T2-2K80-1LZH-N4SC-44V33M912MB9} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{760L5Y01-3WCG-O7C3-J610-55DF39DIP814} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{IN78259C-2RRY-F38F-EJ6B-D4UY15910O70} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AE3TUA3V-93H8-C16O-W0P6-02ORU1NT9047} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{TC33Q0B5-5113-WDHP-UD4K-71C66T245TIQ} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CFI6BH5-503R-V9KL-R905-YXD3UW1NR826} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7VA5792-LUB0-JUTG-G48B-EKZ2ML60K4VI} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{TBK5S114-6FI6-6G45-0X23-9ZKR90ENXC3J} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{VJ768D56-Z24Q-ALSP-0FOY-D3LX2DS8WHO8} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DDRTY468-137Z-9HSR-EE7U-Z4791KTA0ITS} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DCPP12KX-136V-EL4T-EDQQ-72LOUJ6WV04U} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{U9038E33-PZ3J-7223-V013-984JQB3K7W24} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EF49E3Q8-14L7-1166-FG49-F3682MM7G2S7} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{YW4Q0025-RFE5-7Z45-U12M-W81L9BK3Z2HT} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{59W037WD-M6F2-68EH-K7DI-56143X0MMTA1} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{4MY21T93-IP89-5L80-G7UC-L5T1147FJ76H} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{NYF457B4-6WYK-S01J-770I-LZ324S12O80F} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8CFI6BH5-503R-V9KL-R905-YXD3UW1NR826} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61J5V03Q-Q933-W8KM-6145-804SR0L4X90N} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{5QYGKP90-H5BE-55DJ-38U1-288HNU9AKTZ1} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{UA22709O-7DEK-673G-QW0N-PXGKO90G5BE5} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{F7VA5792-LUB0-JUTG-G48B-EKZ2ML60K4VI} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{EF49E3Q8-14L7-1166-FG49-F3682MM7G2S7} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{046ZBP59-DJV8-15R8-GHNV-34UUZ2RT0JNC} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{C2RSYG78-FFK6-CE4U-YN59-24P7046X94SQ} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{H3QUC369-326A-15RT-94R8-D36YY27611SU} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{C037A0L9-YB57-8CQN-E03T-B1M59D578D25} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{K5W046C9-4U83-LN62-L691-4TS0M4Y9MO72} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{4U8F2S83-NQWA-INW1-5W8G-3T93ORXCJPY1} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8K380JLP-9IN7-7255-B2QR-X138UEJ5BDLT} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Active Setup\Installed Components\{27DCH5ZB-3SW0-4819-M693-5U83QO1H279G} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C1P71KNT-XFKT-04I7-D2Q7-8LOUYGMU0438} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1LPEE58-1F37-02N5-0J68-AK46ZBPZ9DJV} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{Z5S1136U-H268-B55X-23OY-92N0DNMC3JW7} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{H3QUC369-326A-15RT-94R8-D36YY27611SU} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{10JT0C4O-9CP7-8125-71KU-1D5P01Q89136} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{T8258A05-WU3N-Y92M-PD0L-Q8I470F3UUBI} 77e2c26553905fe3dea8deb624b6fa2c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{A3K9X24S-1FN8-0E56-8D6U-11S9043784LW} 77e2c26553905fe3dea8deb624b6fa2c.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{9F67035R-CNUQ-1HQA-F4MZ-HFTYY3Q9A5M8} 77e2c26553905fe3dea8deb624b6fa2c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2544 77e2c26553905fe3dea8deb624b6fa2c.exe Token: SeIncBasePriorityPrivilege 2544 77e2c26553905fe3dea8deb624b6fa2c.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2544 77e2c26553905fe3dea8deb624b6fa2c.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
989B
MD5380fcb60672b67212f4a51160fdb015c
SHA1edd235b3d3e4d6aa85995e9f1d7b6ea8065bc6b5
SHA2563e804e45b6fba3e76d731dd1d35e826806a927b905f844cf8b60428bbe109066
SHA51256ce7fc59aa34583d2f1eb783a2da6c6285a0009c8471f3f6fa40acf8bdf78ead9951125b7705a180fe8e27ee73dbe6bbde2be7f0f0b3a96c86f8d0bca97e149
-
Filesize
2KB
MD5dd56c6135ab70a7783e8a181d4eb968a
SHA16a68554ee0d19830a4a962952efefadbcc545f61
SHA256cabf140dde01785313b79ee598ae93425878ea4253c10d39570394718a94ec19
SHA51222d899a98ab952d8ccd463d56406ec0e4fcf6a59bce00a32e4d755e323e2b453969e67df1e4258fd8b274fc6ae24ae2cefe9769576a2fad1b949d3633187e06b
-
Filesize
2KB
MD57ae4af1355be1f01cb85186c87383faa
SHA12b9413bf5fe1c32ee8f6298699545fd6161a065f
SHA256561a57d3238c101e51cd35ea7e5e5e9cdc47f1c6f07e91477b382164769de504
SHA512efd1877bc1d22e923e4f4dd3adefbefe6c0727baabc6dfc1a02d1f07f058bf94e7c98297d540261adee2a2cdf7b7527e8fbe759dd5e5dd59b4ba0a8f8c0b4c84
-
Filesize
1KB
MD5d992605dd4c3f4a949250f4f97ddf6d3
SHA1ff59e5a0a388a14820cfb38ebc730e59330b7603
SHA25608f0c0bbf04fc758908f966abd6bbe43c789f60cf515d9a85f9e6b9f313c8485
SHA5128ac1711d34a6b0b1f05a3efd435c41a687cd8ba95aab34843b974cae24db456e2b9ace3c3c09ab9880190a2c625298dc42e938f3aa3fe99755a9722a86d3b5e0
-
Filesize
2KB
MD5962a8478c29e16ea504d818bf7d4d0a0
SHA1a5af7db8354a116f1aeac07bef8d0d651706961c
SHA25639f763615057aaaae18b312e743a15fe6ed6e7585f8c8010d6a6751ec671287e
SHA51211d1f851cf7d4350f6a3a2aae279f80b197f2e6982e71bc22593d77809e0b1c37ead80aa3ed96c4671658725c8bb69bd88cca8dd8bc5958f222c790f1df48b26
-
Filesize
923B
MD50b022e703dbb51f1e4f1deb32d4d1ced
SHA1aae42fe3a05380d66c87f51b10b4d067cbd48f4f
SHA2564805b9017f3a9deb5b974fbb9f3d57bd29a49b747e152c2141b2a6b0e0712ed5
SHA51293bbd5d36d7fb99433e04536fdb1ebfcfb54ba225ca56f31f52aabe31ae6e5bb595f2ee5cb4db7e01e8e16e900284adfe7995cc9762d9369d27739b16a19e254