Overview
overview
10Static
static
10samples (2) (3).zip
windows7-x64
1samples (2) (3).zip
windows10-2004-x64
1100b8bfff5...48.exe
windows7-x64
1100b8bfff5...48.exe
windows10-2004-x64
116b5122423...49.exe
windows7-x64
716b5122423...49.exe
windows10-2004-x64
72727dde741...98.exe
windows7-x64
92727dde741...98.exe
windows10-2004-x64
929dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
93c5ffe21fd...017.js
windows7-x64
13c5ffe21fd...017.js
windows10-2004-x64
148493bb68b...20.exe
windows7-x64
1048493bb68b...20.exe
windows10-2004-x64
10568a79ce58...19.exe
windows7-x64
9568a79ce58...19.exe
windows10-2004-x64
957de0d2d59...fe.exe
windows7-x64
957de0d2d59...fe.exe
windows10-2004-x64
75e34ceeaf6...05.exe
windows7-x64
15e34ceeaf6...05.exe
windows10-2004-x64
16e2db44578...ac.exe
windows7-x64
96e2db44578...ac.exe
windows10-2004-x64
975342ada93...76.exe
windows7-x64
875342ada93...76.exe
windows10-2004-x64
67e623dca8a...e2.exe
windows7-x64
107e623dca8a...e2.exe
windows10-2004-x64
1087f2db714e...7e.exe
windows7-x64
887f2db714e...7e.exe
windows10-2004-x64
88dcb1af1e7...b0.exe
windows7-x64
78dcb1af1e7...b0.exe
windows10-2004-x64
7Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (3).zip
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
samples (2) (3).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2001.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
2001.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
-
Size
167KB
-
MD5
11442c43bbe7810c91a58af6d92ac810
-
SHA1
027d4ef6a11a59ca7588a6a3eed0b4ee368206a5
-
SHA256
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76
-
SHA512
9fef88249f11afa4bc057bbe095114273e68e962ab015b89648b0708d1dee6e822a0e0e209512ad6d9fadc57cfe1d6fbfa54a13c4e1bcb59a8881cf1fd7a64f2
-
SSDEEP
1536:XWF0Tz+2x+/m2x+kDgJF+2x+/m2x+kDgWGekNsGekNFuJGekNsGekNRl:VTz1+l+kcJF1+l+kctphp1
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Documents\desktop.ini 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2928 75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe Token: SeShutdownPrivilege 3008 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe 3008 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe"C:\Users\Admin\AppData\Local\Temp\75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3008