Analysis
-
max time kernel
1799s -
max time network
1173s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-01-2024 19:02
Behavioral task
behavioral1
Sample
getConfigFiles.exe
Resource
win11-20231222-en
windows11-21h2-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
out.exe
Resource
win11-20231215-en
windows11-21h2-x64
1 signatures
1800 seconds
General
-
Target
getConfigFiles.exe
-
Size
386KB
-
MD5
e592977c62769c90f8d2f816156c0974
-
SHA1
78c75129c1e24f2b991964395a1864fe4d5b8ef0
-
SHA256
9661bcb0ee613c3e43d5356fd52129557115bb4c4e923b9367670adcdea00820
-
SHA512
b21b148577b8e0f5436ea2d2cacd0d341493440f318a62a9f9b09753531505c8f68d952057148f5ecbe5e31ecba288b23b6897ab8077daa05ef3b6ab708ca72a
-
SSDEEP
12288:UzYwKuEYUhoMO+xxmYrkwDDV69XVaFMq/F5:csZYUhoM/LmKoUM45
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/4540-0-0x0000000000400000-0x00000000004BF000-memory.dmp upx behavioral1/memory/4540-1-0x0000000000400000-0x00000000004BF000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/4540-1-0x0000000000400000-0x00000000004BF000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000097574d03120041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe97574d0338585d982e0000004457020000000100000000000000000000000000000048b5c8004100700070004400610074006100000042000000 getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000038585d98100054656d7000003a0009000400efbe97574d0338585d982e0000005957020000000100000000000000000000000000000049f79000540065006d007000000014000000 getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 getConfigFiles.exe Set value (int) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" getConfigFiles.exe Key created \Registry\User\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\NotificationData getConfigFiles.exe Set value (str) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000009757630510004c6f63616c003c0009000400efbe97574d0338585d982e00000058570200000001000000000000000000000000000000602920004c006f00630061006c00000014000000 getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff getConfigFiles.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ getConfigFiles.exe Set value (data) \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 getConfigFiles.exe Key created \REGISTRY\USER\S-1-5-21-4286256601-2211319207-2237621277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 getConfigFiles.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe 4540 getConfigFiles.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4540 getConfigFiles.exe