Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
804dbcd3d7563083b52efdbcd08e7080.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
804dbcd3d7563083b52efdbcd08e7080.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
804dbcd3d7563083b52efdbcd08e7080.exe
-
Size
634KB
-
MD5
804dbcd3d7563083b52efdbcd08e7080
-
SHA1
e537bfce4f41adf9aeeed3df29b1052c78e346b6
-
SHA256
e8fc01580af330bb80fe2ff41a3572df2b7c0d58a5fac75593c7a3027f24496d
-
SHA512
068530984b8d37d13d5d0190c29d7e45220cc0501ee94ebf2357e7ef4bed8e663d7a2727e7c7fa2a18bce7a0f18b9aef52ef808c28e847f586ca3e40e408f45a
-
SSDEEP
12288:oKRgoZ5ghVhtqVqjhVhJqAqyiECggcp9H3NR9X:DbZ5UqVqPqAqyWuX
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 18 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe2300001000d09ad3fd8f23af46adb46c85480369c700000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe 2568 804dbcd3d7563083b52efdbcd08e7080.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2140 2568 804dbcd3d7563083b52efdbcd08e7080.exe 28 PID 2568 wrote to memory of 2140 2568 804dbcd3d7563083b52efdbcd08e7080.exe 28 PID 2568 wrote to memory of 2140 2568 804dbcd3d7563083b52efdbcd08e7080.exe 28 PID 2568 wrote to memory of 2140 2568 804dbcd3d7563083b52efdbcd08e7080.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\804dbcd3d7563083b52efdbcd08e7080.exe"C:\Users\Admin\AppData\Local\Temp\804dbcd3d7563083b52efdbcd08e7080.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" shell:appsFolder\A278AB0D.Asphalt9_h6adky7gbf63m!App2⤵PID:2140
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2740