Overview
overview
10Static
static
10samples (2) (3).zip
windows7-x64
1samples (2) (3).zip
windows10-2004-x64
1100b8bfff5...48.exe
windows7-x64
1100b8bfff5...48.exe
windows10-2004-x64
116b5122423...49.exe
windows7-x64
716b5122423...49.exe
windows10-2004-x64
72727dde741...98.exe
windows7-x64
92727dde741...98.exe
windows10-2004-x64
929dd920ac1...e5.zip
windows7-x64
129dd920ac1...e5.zip
windows10-2004-x64
12001.exe
windows7-x64
92001.exe
windows10-2004-x64
93c5ffe21fd...017.js
windows7-x64
13c5ffe21fd...017.js
windows10-2004-x64
148493bb68b...20.exe
windows7-x64
1048493bb68b...20.exe
windows10-2004-x64
10568a79ce58...19.exe
windows7-x64
9568a79ce58...19.exe
windows10-2004-x64
957de0d2d59...fe.exe
windows7-x64
957de0d2d59...fe.exe
windows10-2004-x64
75e34ceeaf6...05.exe
windows7-x64
15e34ceeaf6...05.exe
windows10-2004-x64
16e2db44578...ac.exe
windows7-x64
96e2db44578...ac.exe
windows10-2004-x64
975342ada93...76.exe
windows7-x64
875342ada93...76.exe
windows10-2004-x64
67e623dca8a...e2.exe
windows7-x64
107e623dca8a...e2.exe
windows10-2004-x64
1087f2db714e...7e.exe
windows7-x64
887f2db714e...7e.exe
windows10-2004-x64
88dcb1af1e7...b0.exe
windows7-x64
78dcb1af1e7...b0.exe
windows10-2004-x64
7Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2) (3).zip
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
samples (2) (3).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
100b8bfff550fb74c98a2ef9a71d4bb53553d2d7ba509bb451fe32814ec57e48.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
16b51224239d3671b1af3e8f2656a2ad1e7f5fb9acb09111a95461338a841b49.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral8
Sample
2727dde7418284bd2b16a032346a9c6921cbfb5e950ad21c9468792b71ee3898.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
29dd920ac1453b5be12fcef5af45690dbbe625e985f6692e237a057e832937e5.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
2001.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral12
Sample
2001.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral14
Sample
3c5ffe21fd24c4daf62f5190d96e65bf7a25232ef9ec956a77db910e90750017.js
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral16
Sample
48493bb68bc1062b11cc505e444db288ec6cba0c979d10a9b5a3ea775daf9420.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral18
Sample
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral20
Sample
57de0d2d5945db11d6c845459419a1b48a5cf415a7a0866c40b03afaec6fb4fe.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral22
Sample
5e34ceeaf60a7cdfaeee0443a87edb92115727130323314628503dfe755b9505.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral24
Sample
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral26
Sample
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral28
Sample
7e623dca8a26a45440c331e383ac6ce3783d5c1bd60b91ee91ce0cc5841633e2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral30
Sample
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral32
Sample
8dcb1af1e7886834252394e9710ee72b9bfa910779c4ea041831d0622efa85b0.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
-
Size
168KB
-
MD5
858f74b2c777c086eaa36d9cfd4f38d2
-
SHA1
ccc4e31495008464118c71b55e27ace1fe35736f
-
SHA256
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e
-
SHA512
c30e692885aab0bc30dba82a1ee6037b25de56027fb06564062991713e9f062c2b5d9fbcdd802aa0f7503b1ea8942bd9641b7b2299b4e341aa5f41b4739af0c5
-
SSDEEP
1536:R9vtiz8f+2x+/m2x+kDgJF+2x+/m2x+kDgWGekNsGekNFuJGekNsGekNcl:+8f1+l+kcJF1+l+kctphpS
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Documents\desktop.ini 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2396 87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe Token: SeShutdownPrivilege 2740 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe 2740 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe"C:\Users\Admin\AppData\Local\Temp\87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2396
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2740