Overview
overview
10Static
static
10samples (2).zip
windows7-x64
1samples (2).zip
windows10-2004-x64
104035f6fdd...f9.exe
windows7-x64
904035f6fdd...f9.exe
windows10-2004-x64
70ed3c87ce3...07.exe
windows7-x64
40ed3c87ce3...07.exe
windows10-2004-x64
11ce291b079...c9.exe
windows7-x64
71ce291b079...c9.exe
windows10-2004-x64
130e66f95b4...49.exe
windows7-x64
830e66f95b4...49.exe
windows10-2004-x64
8335160bee7...cf.exe
windows7-x64
10335160bee7...cf.exe
windows10-2004-x64
103d7dd597a4...67.exe
windows7-x64
13d7dd597a4...67.exe
windows10-2004-x64
742dcc46f9d...46.exe
windows7-x64
942dcc46f9d...46.exe
windows10-2004-x64
84fcaca23e9...f2.exe
windows7-x64
104fcaca23e9...f2.exe
windows10-2004-x64
105994300c1c...a7.exe
windows7-x64
105994300c1c...a7.exe
windows10-2004-x64
9627a5569d4...e3.exe
windows7-x64
7627a5569d4...e3.exe
windows10-2004-x64
10kf12.pyc
windows7-x64
3kf12.pyc
windows10-2004-x64
163fa775052...2f.exe
windows7-x64
163fa775052...2f.exe
windows10-2004-x64
1645b8dfe73...79.exe
windows7-x64
1645b8dfe73...79.exe
windows10-2004-x64
164862ec699...1b.exe
windows7-x64
964862ec699...1b.exe
windows10-2004-x64
10741d75a02d...5e.exe
windows7-x64
10741d75a02d...5e.exe
windows10-2004-x64
10Analysis
-
max time kernel
17s -
max time network
70s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 15:12
Behavioral task
behavioral1
Sample
samples (2).zip
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
samples (2).zip
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
0ed3c87ce3ae58f3dcbf46fa022acd3cbbe0b96af2e9f7a47eee0dd50af88507.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
0ed3c87ce3ae58f3dcbf46fa022acd3cbbe0b96af2e9f7a47eee0dd50af88507.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
1ce291b079977e7a3f81c44b644fe1f63ae34a0a1a5c264e9f6085c184f7a1c9.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
1ce291b079977e7a3f81c44b644fe1f63ae34a0a1a5c264e9f6085c184f7a1c9.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
30e66f95b46c8162c921648e31f8c4146ba3f0580f4e5aa3b4c4de18687f6a49.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
30e66f95b46c8162c921648e31f8c4146ba3f0580f4e5aa3b4c4de18687f6a49.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
335160bee7e253c4ffa69e5164c4a36fe5fb4be2c246958dfcc509d8202db5cf.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
3d7dd597a465d5275ef31d9e4f9dd80ed4de6139a1b3707cb3b0ffa068595567.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
3d7dd597a465d5275ef31d9e4f9dd80ed4de6139a1b3707cb3b0ffa068595567.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
42dcc46f9d6e6e8efe3f95bc09dbdfb6206a52a4347dbb652f315cec483a2046.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
42dcc46f9d6e6e8efe3f95bc09dbdfb6206a52a4347dbb652f315cec483a2046.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
4fcaca23e9cfb7e5448f41bb520c9c35c68fd795ac6b3707d0c64cf92738acf2.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
4fcaca23e9cfb7e5448f41bb520c9c35c68fd795ac6b3707d0c64cf92738acf2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7.exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
5994300c1c7d099bec13d2a6aec942a6a866966e9545773d3fbe26cc5e308da7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
627a5569d47d6c66be6888e4f68f0a50e491404a08da1a7d9242c2d29e3e8ee3.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
627a5569d47d6c66be6888e4f68f0a50e491404a08da1a7d9242c2d29e3e8ee3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
kf12.pyc
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
kf12.pyc
Resource
win10v2004-20231222-en
Behavioral task
behavioral25
Sample
63fa775052a5c7258d44a00d9f2b4a9263f96fb7c61778cbb1ba9102fed2082f.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
63fa775052a5c7258d44a00d9f2b4a9263f96fb7c61778cbb1ba9102fed2082f.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral27
Sample
645b8dfe73255d9e5be6e778292f3dde84ff8c5918a044ae42bcace0fe9ca279.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
645b8dfe73255d9e5be6e778292f3dde84ff8c5918a044ae42bcace0fe9ca279.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
64862ec69991a7d454c3ea3a0c3a8f1cc9c80192078740b9c753abbf1b7bef1b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Resource
win10v2004-20231215-en
General
-
Target
04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe
-
Size
2.1MB
-
MD5
e4bf35b81bfaa0e789ad9461dbacb542
-
SHA1
dcf7b855b2c3516a6b88a410ef5b44a2c650f62d
-
SHA256
04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9
-
SHA512
6635342515a01acde48792cb362dc9e5bd7ffc4fe6a9b8b2fdb0d6c8758d79db847daf28e2fe700a898425214d95d2707337c900c695a47cfd9dada946adf64d
-
SSDEEP
49152:Iw80cTsjkWanAlfiebWlHcA+G6HYaqK3hUQrObmyPYjR+:Z8sjkrgWezG6lh73jR+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3756 yk7E131Y1C.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\yk7E131Y1C.exe" 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4880 PING.EXE -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 16 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 53 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 3756 yk7E131Y1C.exe 3756 yk7E131Y1C.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 3756 yk7E131Y1C.exe 3756 yk7E131Y1C.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1436 wrote to memory of 2312 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 27 PID 1436 wrote to memory of 2312 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 27 PID 1436 wrote to memory of 2312 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 27 PID 1436 wrote to memory of 3756 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 108 PID 1436 wrote to memory of 3756 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 108 PID 1436 wrote to memory of 3756 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 108 PID 1436 wrote to memory of 2240 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 107 PID 1436 wrote to memory of 2240 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 107 PID 1436 wrote to memory of 2240 1436 04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe 107 PID 2240 wrote to memory of 4880 2240 Process not Found 100 PID 2240 wrote to memory of 4880 2240 Process not Found 100 PID 2240 wrote to memory of 4880 2240 Process not Found 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe"C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.docx"2⤵PID:2312
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 1 localhost > nul & del /f /q "C:\Users\Admin\AppData\Local\Temp\04035f6fdd921309391aef9c88e550d8b3d31c7a4ea80267cb436f491aedd1f9.exe"2⤵PID:2240
-
-
C:\Users\Admin\AppData\Roaming\yk7E131Y1C.exeC:\Users\Admin\AppData\Roaming\yk7E131Y1C.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3756
-
-
C:\Windows\SysWOW64\PING.EXEping -n 1 localhost1⤵
- Runs ping.exe
PID:4880
-
C:\Windows\SysWOW64\whoami.exewhoami /all1⤵PID:1296
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami /all1⤵PID:3560
-
C:\Users\Admin\AppData\Roaming\yk7E131Y1C.exe"C:\Users\Admin\AppData\Roaming\yk7E131Y1C.exe" /AutoIt3ExecuteScript "C:\Users\Admin\AppData\Roaming\yk7E131Y1C.tmp"1⤵PID:3576
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"2⤵PID:1368
-
-
C:\Users\Admin\AppData\Roaming\yk7E131Y1C.exe/scomma C:\Users\Admin\AppData\Roaming\~mED216D4A93FF.tmp2⤵PID:4884
-
-
C:\Users\Admin\AppData\Roaming\yk7E131Y1C.exe/scomma C:\Users\Admin\AppData\Roaming\~pED216D4A93FF.tmp2⤵PID:4344
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami /all2⤵PID:4132
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"1⤵PID:2696
-
C:\Windows\SysWOW64\whoami.exewhoami /all1⤵PID:3524