Resubmissions

22/05/2025, 18:49

250522-xghassxrw7 10

22/05/2025, 18:46

250522-xepl4axrs6 10

22/05/2025, 14:22

250522-rpjkyavrv4 10

22/05/2025, 14:18

250522-rmk1zshj4x 10

29/04/2025, 21:41

250429-1j52estms7 10

22/04/2025, 17:09

250422-vphkeswlx5 10

22/04/2025, 16:35

250422-t3tzya1wav 10

14/04/2025, 17:40

250414-v89s1swlw9 10

Analysis

  • max time kernel
    101s
  • max time network
    101s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 10:05

General

  • Target

    bazaar.2020.02/HEUR-Backdoor.MSIL.Revenge.exe

  • Size

    16KB

  • MD5

    fc8f4e31d85e796c1efe9b0fabeed23a

  • SHA1

    e15233a69c32761d8ad0e293ce1ed2e1162d5647

  • SHA256

    c35e3bdf0d1a7275e73f3c8c9fb57cf874ffa19ffafae649025b1e90cd07c096

  • SHA512

    36e40d94711c82fb1669e3143d63833a3f7ad1b0ea8dae00287cbcdfd154135a3d7042702e4900193d0dcae94b0d03f7b6a9fb545e20c709fd4fb4a1cae95351

  • SSDEEP

    384:sxF6Mj9VnRq2Rj9oM+bYO+4kr9oDPlMNcLlb5sVKdyS5Ct:sxF6Mj9V5bDclMNE9o

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Revenge.exe
    "C:\Users\Admin\AppData\Local\Temp\bazaar.2020.02\HEUR-Backdoor.MSIL.Revenge.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2900
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2768
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:784
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275463 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1640
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2668

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

            Filesize

            67KB

            MD5

            753df6889fd7410a2e9fe333da83a429

            SHA1

            3c425f16e8267186061dd48ac1c77c122962456e

            SHA256

            b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

            SHA512

            9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            91ef3286617c1cae8c637c919672373c

            SHA1

            11c3999d7f11f16b6d8438d6308a83367cc4ef34

            SHA256

            1ee6baa3292cb1f82a58a102037003b546947602bb8306d2f38e8e0b75284cdc

            SHA512

            278da4215fb3482b57591cfc68c9ebaffae0539e717ef0a71298227baac30996fa7e73920b861b742e7ef4f8aca3a3b036698d97e1b2f6fa26b58c14252289df

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            c77266881510d5ec66c167d0e452d3ee

            SHA1

            63d41b438484f0f481d78205de361ba4888817d3

            SHA256

            206a80e47890820f0751ec01f443b82102fa0e05978553470f542e3c1d55c877

            SHA512

            ef8aed6d0db52857e399cec73f099a7f96008945edabfcbe47cb7464d19647d68c2e4f183ec780e16b02e7e5623ba6f1db39ee88ebf25b792938c94b73dd67c5

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            4337309e3fe04e48382464876838920d

            SHA1

            64eeb9aeaf83026eafab0b8dd8e2ca93d7bb203b

            SHA256

            198dd00d82fa1bfa5cb434475f5cfd91b723f0d96a7da266ee42fe80e6c6bfaa

            SHA512

            df3fb8a64698a0a9718188243ffb1828bfc89d6a893ef2abc41eaa5a23f670336c291604a430a2525d001708eed476497af397d50e07fc771f45a7965668accd

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            5006c0b1f10d3975883b6f054e9f0788

            SHA1

            ef5be3f70c605411bc0478d95787a412f28f3b8a

            SHA256

            0b7b02440890c446af95158513419c00d9be40a8c3114570e4cfafdb4b37a3b5

            SHA512

            6b994a18859d751c28a2306de93ce72ddb4b6254d5ecd435d0bb96a3741d4b716d1f5b7f8a7ea7c6f4a2985078ba011a86abe21365010af86d922f07db4ff373

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            0414e7c9f345471fe5395fb74b374544

            SHA1

            3e6e6118e55cb6946a43967b5c10c25887b5c4c5

            SHA256

            85e03eff5c24a5aa08ce36782440f03943515f6a3c63073c65fd7ca84f9cb7fc

            SHA512

            9a7feb5cabdbe6fd9d718b785c70a2a601b6da3d3be1c7f640d0b4deda8ffb0a1019db4cd54e7c27c0bea04bf2f61e8753239d99581fe75f00a21c695d923631

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            0d6187bee86be905cb52789e3a2ab4a5

            SHA1

            62651b7f6519b3932f07bb31be485627d03367f2

            SHA256

            2cdf05571a5c1aef193eacc5b8c6154670d2bc247649b874c1add4a943be47ef

            SHA512

            cfa8b6513bb7507eec4cc17bd9cdaee342257ad4a667135aaadb6602ca03b9ae304899925c1fa0be91340ef985bbe35f67d3783731711b5f5d50503bc4f237ad

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            bf4c3dd68f346c9a444f14bba2b7be84

            SHA1

            c619584e32f5e646202534837d5e0977f7c3f08c

            SHA256

            94805feaa06662e695b0e691d16dca630657ba2cc277d7b3d7f17d19ddc33e01

            SHA512

            6fe0be322adf3256316a405b3295aff5615afb97b549bd1cd309653d824551e945872adf03e36257e71c3aca21c5f1eb14e14932695caad0ca58bcd3fbb682b2

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            9f97a479f4ca2eb462821eb6dcf97d6f

            SHA1

            64243ed9cad32a6f99095e7a5af3869e3d36913e

            SHA256

            fa7c530a820a9d9417d7ee206be6e241be3ec43c7ce62debf3f3ae707179cff3

            SHA512

            2a4812e6061008ed913892cd71a3fd6bba03046a08ff76e73e7e7200cd49c9ccc2653d860a9477ba1f56dc35426a68cc82146a6f0fdb96f5ef5c1ac4171d013f

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

            Filesize

            344B

            MD5

            63945f15395a0f79bf2e65f61759bbd7

            SHA1

            3dd83e78e6f93b0cf800830ee54963495ba948be

            SHA256

            6967b54de2729c8ea73a9e8a9d0153fa5f9d441bfd6847d93a9e8994f5323eec

            SHA512

            b9a128acac380ddc63ba4f0b1e4e59db3e4280ff3adf8bca939faa5b6e15a7ffe7481d0e6ceb6f7eaf4c98c57c3d1a003a6e352815848f61f860b5b5b73723aa

          • C:\Users\Admin\AppData\Local\Temp\Cab33.tmp

            Filesize

            65KB

            MD5

            ac05d27423a85adc1622c714f2cb6184

            SHA1

            b0fe2b1abddb97837ea0195be70ab2ff14d43198

            SHA256

            c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

            SHA512

            6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

          • C:\Users\Admin\AppData\Local\Temp\TarC6.tmp

            Filesize

            175KB

            MD5

            dd73cead4b93366cf3465c8cd32e2796

            SHA1

            74546226dfe9ceb8184651e920d1dbfb432b314e

            SHA256

            a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

            SHA512

            ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

          • C:\Users\Admin\AppData\Local\Temp\~DF2FCCF91176B4BD83.TMP

            Filesize

            16KB

            MD5

            becacf84d630136840bc68f0d782f7a1

            SHA1

            9c8af4ba850475f56f98f14e686eacdcba6161b3

            SHA256

            231f1e034a330acfe6c579bb997584fe05d40485caa902c244f20c2088f240ca

            SHA512

            627061038716db3dc01f408e5ecb5a2492168ebadb405b0038c72611b3d9f3ce34d82a0ff5986d82b061efde4b38d40942c575c35519fe3579d6c1a5761e415a

          • C:\vcredist2010_x64.log-MSI_vc_red.msi.txt

            Filesize

            162KB

            MD5

            e4bb258a0b2af2d753e17af5c455c3d9

            SHA1

            8bbc52454b7450d07566f24175dc5adfef1ecbf9

            SHA256

            1ef3f208c7a68dcf3680ce2a50449dca8931c63ff5a14c84bf28ea01acb36d42

            SHA512

            281e968a7f610e74cdde0068ba3e32a74eee4466dea5fb75341d23383708c3b9de3f6b1fdd7c8d1cc01493daca186be6b32eb6f349fdafb378f4163a3641e0a7

          • C:\vcredist2010_x64.log.html

            Filesize

            86KB

            MD5

            8a8e68a0f1fead33c3ff6b060dbe5b1f

            SHA1

            2d9119e96545b2da7f4b573deadb1a31978aeea8

            SHA256

            a11ee5b7c1409324ca22f2107208b876471ad0c1b9ffa65a31501cecaa104f72

            SHA512

            341ce2c5707a60dd4c83e9444a7e9f8daa636ef2f9d57e56c70a3ecb38459eab3b03784e91511baf374f26e4ea21d684c308a18f6be186505e71bcb56a7ecaa4

          • C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

            Filesize

            378KB

            MD5

            400ab04c0eadd12fd963b6870b004021

            SHA1

            b57d706edd6e1816265eefcec6d3b0feafa33940

            SHA256

            b56f90b259b7f11288aebf9cddf234c9aff2a387563b22d1c686043b185dd539

            SHA512

            6327c16f77fd5bcf2fa5ba2f7f3279849f6410dd5b36957ad4c33657081d6720b725f0ae543e48df33a64a780ecd107da99253b342823dcd16a80e1e2ae955a9

          • C:\vcredist2010_x86.log.html

            Filesize

            64KB

            MD5

            22f1f4fbe6927b76568a4c338ed6e3aa

            SHA1

            8adbe9bf817116accf5f5e9cc2a48ab467bee591

            SHA256

            1d7c9f65458464f2b10b80674160670a9e545b33c9b1b4e2d5b4addb68ef5f6c

            SHA512

            66637dc301f57530c59d789450e5f44e1874fb161bf08fa5db33777b09db41216e8e32c43b91257cc192a957e381738efbb002ee73f11091a436787e611adf8c

          • C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log

            Filesize

            165KB

            MD5

            c92ef61ba991096d7f4d5d9054e510d5

            SHA1

            88b60da4841527a42433398f890d1f18be6a2577

            SHA256

            2ea9266061b79128d38f6c21cc902874c81f2f76164efa668d9b6c98c3cb8548

            SHA512

            d96ced8786a4f83bb068db75034c43dec71f2257d9535af94b7fbb7291620a319bc1951429cf38c08feb7a05eb13fa287bb7db3500973effa26f6fb24b0121d4

          • C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log

            Filesize

            193KB

            MD5

            df9a6d40d662b6dd792fe83115c1b507

            SHA1

            ee3d1fcbb4bc8570e1d6210278f4d08e60c59364

            SHA256

            1f48508faa87e158f3b2bdcaeffb4ff727d9953e2aa23ba32f058a83896e5cbd

            SHA512

            849ec55ee539dd401af801b9ffa2baa461e864de0788aa59003480f1a771b15d572ff7e4d59d4e5093c599832595cda86291081507d9ef235b441774442f0437

          • C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log

            Filesize

            168KB

            MD5

            62047ac34304651ce947f83323aca333

            SHA1

            9116dee2e416fa5a6fd2dfbdc38b77512a095909

            SHA256

            58625c3a38cec1ad9de029cc3c0f9f0e8de08cd2249c2232d59f020128ff920f

            SHA512

            c6ae323357653c1d6a549a54ddc615caf034c95654b966232d4d1f81d93fac6cf79a158d0f14b233690eae0a8b318c43a5ab4622e036fbc8a3be04e145d65760

          • C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log

            Filesize

            206KB

            MD5

            3f24abc57ce58e6ea4c25e3c44582510

            SHA1

            8f3f15030ba962d7a3bc39ec532f9491008c71d1

            SHA256

            45f41f57381deec0e3e746707b7c0ce62ac816939e7f152588548411aa01f7a1

            SHA512

            6ebee59aa01594a22c4f15cb111a754e56038f7fd350799fdd69052118796e58f0124fdf3a99de3c2ce723dad6dcb098505bfd9b662ac1aa040589ebbb9a5162

          • C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

            Filesize

            167KB

            MD5

            ea8fe389cd2039ff02e766f6c7c694fc

            SHA1

            e8edfd1f57d4188ac89eff5df610c6b767d46394

            SHA256

            7c360f2a1e5d29605e1c3a17142c736e83cffe84e8e5e109c933133ced59b231

            SHA512

            f13a250c0c79c273d5ef6a6dfa422bdef8514caeaa290c090df24d617e056af5b1c3d70ff82033871a716758b97d6d0d32286bac6c91681c5ecac096a1a7b640

          • C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log

            Filesize

            188KB

            MD5

            4dcfddb76ed5cef95b545533d5872c9c

            SHA1

            c2b972d0a15a9cc8fd9ba74a63c9f0b85c7b8f7c

            SHA256

            867a392e2b4f04fc117d1c844ef6db7f2add741ef8a1e8e1efd215df6786d2f1

            SHA512

            20dc2f183424f890650c3dcffa1d49c81d389560252a2ae7ce9a49e586bbec52def4c7acba11ee0501d34752151c54e898824be825c247f079ec8f619df2c6cd

          • C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log

            Filesize

            168KB

            MD5

            16dc618d393a51b32635b4ecb4e9e0d5

            SHA1

            3c708c9c852ea0191438a83bd9785ab50270f5b4

            SHA256

            5520386695f3927a6a4964eddf3ba6d81f39a547e8dfa33ec4a9f8679c98dcbb

            SHA512

            46dd291fc6356cea7f048d91c1df9a0bd86fbda9bb51121c8d5d2850c4565efa9ac56cc16dc4c8c3fa9712d885245a411280892a53ce9c0d112d8a4bc8b4cd0a

          • C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log

            Filesize

            196KB

            MD5

            f629ab87f8bd4fdb971993c5fbd87349

            SHA1

            9f929a7f973f59dd00a987ea194253d585d5afad

            SHA256

            b1fa57956b3d2ef41859e62e81997cb12bc23ef1aacccd8a8a58c22ef47a47f5

            SHA512

            010b22e1ac738e7e5f343d60a851ec5db9a63e3876d39d6fb5e23346a954f55029a6f051439fb60b795f43e43e6da3b62569561da82ba5c5f16fa732e97275d5

          • C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log

            Filesize

            120KB

            MD5

            d9659c010f79754f11c8faa485000ccb

            SHA1

            52dcdc75f2768b051d503ad5f22bbe84081df666

            SHA256

            8b0f2f1a332e1a714f6e8eb3b25c786383e40f5b135def864ccbdf773ef3d08d

            SHA512

            e8e9368ad5b664162b8ee0eff520e8daf4535f4e00713adb780513a7f71d464476df607bca7160b6fff8c59a2496754f7b8d94e9dd02dff770388987a3a6ee7f

          • C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log

            Filesize

            127KB

            MD5

            d555e89adb2bbbdfa4679521953f7c32

            SHA1

            c493799c01872640d2e8336e58c025cfeafce886

            SHA256

            02ec32bfcb8c5e3743aee59301ffb2923dd57cb16cd816c9802aae337e23f384

            SHA512

            1d868ad088902b24b0779b187fd27b9871351783e28a444f2e1f8bd2a61ad5ec556e5dd981e89ad9952091e85cf06f77ffc59e9ebe9c86b7397ddd7812b85673

          • C:\vcredist2022_x86_001_vcRuntimeMinimum_x86.log

            Filesize

            121KB

            MD5

            1a1cd614ed3cbc881d8e3af6e2132de0

            SHA1

            e508e0cc43c9bf82ff118d3ca27688ff454e12df

            SHA256

            bb561f595219b629b937618b57cec13cf5952114ce2649e6deaf4c6e71c57204

            SHA512

            55ae25f100e6525e61c57822638b83bc1e42919e42ccf1593676cfc12af5c2791221dbf4b3d671f189389f78ca81da630adfb026f87d5640c1da38a1c379211a

          • C:\vcredist2022_x86_002_vcRuntimeAdditional_x86.log

            Filesize

            133KB

            MD5

            e03bfc404c6953ce7cb5a0aa878c7d1d

            SHA1

            7e6df82012ba4b40d42541b9192338546fa1e902

            SHA256

            ed58213c8bfab01e5e2a5e244408930d77abcc2aeb91d2cff5e5ee1115230bc4

            SHA512

            ee41aa02f31cd871babdf12ddfb330fa3c8a08c5acad4f72bee8a01f42e41de0740fa10bdf92ea6c9ec964194fc025d63f585f1b20b67efbdaca91e7bf07b9ff

          • memory/2900-0-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

            Filesize

            9.6MB

          • memory/2900-4-0x0000000000B40000-0x0000000000BC0000-memory.dmp

            Filesize

            512KB

          • memory/2900-3-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

            Filesize

            9.6MB

          • memory/2900-1-0x0000000000B40000-0x0000000000BC0000-memory.dmp

            Filesize

            512KB

          • memory/2900-2-0x000007FEF44F0000-0x000007FEF4E8D000-memory.dmp

            Filesize

            9.6MB