Analysis
- max time kernel
146s - max time network
128s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
06/04/2024, 01:17
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe
- Size 1.4MB
- Sample240406-bneycsgc9x
- SHA256 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e
- MD5 8ecf2c490c81dfc195a95d51033f2e55
- SHA1 555dcc02731ea5df031260a9f94141a6e8301b17
- SHA512 8431bd38f923d05db9acbaa4b79ed88a5f5c625bf3df2380c072fad5aa7fbdc714ab08eccb46cda50b1da4117684a05a795bcc51d9629499f637b1a927a3595b
- SSDEEP 24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8aDSMUB220ZTSVspjHPYnczgFh8OhdQcK:ITvC/MTQYxsWR7aDSjB2hTSu5WLr8OvT
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe - Executes dropped EXE 19 IoCs
pid Process 2508 name.exe 2724 name.exe 2360 name.exe 1044 name.exe 2824 name.exe 2464 name.exe 328 name.exe 344 name.exe 1636 name.exe 2244 name.exe 3044 name.exe 432 name.exe 2064 name.exe 2884 name.exe 1520 name.exe 2896 name.exe 1464 name.exe 2456 name.exe 2600 name.exe - Loads dropped DLL 1 IoCs
pid Process 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe - AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x002f000000016d4e-12.dat autoit_exe behavioral1/files/0x002f000000016d4e-238.dat autoit_exe behavioral1/files/0x002f000000016d4e-251.dat autoit_exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 2508 name.exe 2508 name.exe 2724 name.exe 2724 name.exe 2360 name.exe 2360 name.exe 1044 name.exe 1044 name.exe 2824 name.exe 2824 name.exe 2824 name.exe 2464 name.exe 2464 name.exe 2464 name.exe 328 name.exe 328 name.exe 344 name.exe 344 name.exe 344 name.exe 1636 name.exe 1636 name.exe 2244 name.exe 2244 name.exe 3044 name.exe 3044 name.exe 432 name.exe 432 name.exe 2064 name.exe 2064 name.exe 2884 name.exe 2884 name.exe 1520 name.exe 1520 name.exe 2896 name.exe 2896 name.exe 1464 name.exe 1464 name.exe 2456 name.exe 2456 name.exe 2600 name.exe 2600 name.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 2508 name.exe 2508 name.exe 2724 name.exe 2724 name.exe 2360 name.exe 2360 name.exe 1044 name.exe 1044 name.exe 2824 name.exe 2824 name.exe 2824 name.exe 2464 name.exe 2464 name.exe 2464 name.exe 328 name.exe 328 name.exe 344 name.exe 344 name.exe 344 name.exe 1636 name.exe 1636 name.exe 2244 name.exe 2244 name.exe 3044 name.exe 3044 name.exe 432 name.exe 432 name.exe 2064 name.exe 2064 name.exe 2884 name.exe 2884 name.exe 1520 name.exe 1520 name.exe 2896 name.exe 2896 name.exe 1464 name.exe 1464 name.exe 2456 name.exe 2456 name.exe 2600 name.exe 2600 name.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1504 wrote to memory of 2508 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 28 PID 1504 wrote to memory of 2508 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 28 PID 1504 wrote to memory of 2508 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 28 PID 1504 wrote to memory of 2508 1504 669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe 28 PID 2508 wrote to memory of 2724 2508 name.exe 29 PID 2508 wrote to memory of 2724 2508 name.exe 29 PID 2508 wrote to memory of 2724 2508 name.exe 29 PID 2508 wrote to memory of 2724 2508 name.exe 29 PID 2724 wrote to memory of 2360 2724 name.exe 30 PID 2724 wrote to memory of 2360 2724 name.exe 30 PID 2724 wrote to memory of 2360 2724 name.exe 30 PID 2724 wrote to memory of 2360 2724 name.exe 30 PID 2360 wrote to memory of 1044 2360 name.exe 33 PID 2360 wrote to memory of 1044 2360 name.exe 33 PID 2360 wrote to memory of 1044 2360 name.exe 33 PID 2360 wrote to memory of 1044 2360 name.exe 33 PID 1044 wrote to memory of 2824 1044 name.exe 34 PID 1044 wrote to memory of 2824 1044 name.exe 34 PID 1044 wrote to memory of 2824 1044 name.exe 34 PID 1044 wrote to memory of 2824 1044 name.exe 34 PID 2824 wrote to memory of 2464 2824 name.exe 35 PID 2824 wrote to memory of 2464 2824 name.exe 35 PID 2824 wrote to memory of 2464 2824 name.exe 35 PID 2824 wrote to memory of 2464 2824 name.exe 35 PID 2464 wrote to memory of 328 2464 name.exe 36 PID 2464 wrote to memory of 328 2464 name.exe 36 PID 2464 wrote to memory of 328 2464 name.exe 36 PID 2464 wrote to memory of 328 2464 name.exe 36 PID 328 wrote to memory of 344 328 name.exe 37 PID 328 wrote to memory of 344 328 name.exe 37 PID 328 wrote to memory of 344 328 name.exe 37 PID 328 wrote to memory of 344 328 name.exe 37 PID 344 wrote to memory of 1636 344 name.exe 38 PID 344 wrote to memory of 1636 344 name.exe 38 PID 344 wrote to memory of 1636 344 name.exe 38 PID 344 wrote to memory of 1636 344 name.exe 38 PID 1636 wrote to memory of 2244 1636 name.exe 39 PID 1636 wrote to memory of 2244 1636 name.exe 39 PID 1636 wrote to memory of 2244 1636 name.exe 39 PID 1636 wrote to memory of 2244 1636 name.exe 39 PID 2244 wrote to memory of 3044 2244 name.exe 40 PID 2244 wrote to memory of 3044 2244 name.exe 40 PID 2244 wrote to memory of 3044 2244 name.exe 40 PID 2244 wrote to memory of 3044 2244 name.exe 40 PID 3044 wrote to memory of 432 3044 name.exe 41 PID 3044 wrote to memory of 432 3044 name.exe 41 PID 3044 wrote to memory of 432 3044 name.exe 41 PID 3044 wrote to memory of 432 3044 name.exe 41 PID 432 wrote to memory of 2064 432 name.exe 42 PID 432 wrote to memory of 2064 432 name.exe 42 PID 432 wrote to memory of 2064 432 name.exe 42 PID 432 wrote to memory of 2064 432 name.exe 42 PID 2064 wrote to memory of 2884 2064 name.exe 43 PID 2064 wrote to memory of 2884 2064 name.exe 43 PID 2064 wrote to memory of 2884 2064 name.exe 43 PID 2064 wrote to memory of 2884 2064 name.exe 43 PID 2884 wrote to memory of 1520 2884 name.exe 44 PID 2884 wrote to memory of 1520 2884 name.exe 44 PID 2884 wrote to memory of 1520 2884 name.exe 44 PID 2884 wrote to memory of 1520 2884 name.exe 44 PID 1520 wrote to memory of 2896 1520 name.exe 45 PID 1520 wrote to memory of 2896 1520 name.exe 45 PID 1520 wrote to memory of 2896 1520 name.exe 45 PID 1520 wrote to memory of 2896 1520 name.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe"C:\Users\Admin\AppData\Local\Temp\669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\669813c7b004be6e4fbb29350c526cefa094da76e72bd9914ddd0e84ef03111e.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"8⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"10⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"12⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"13⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"14⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"15⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"16⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"17⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2896 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1464 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"19⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2456 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\directory\name.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ageless
- Size 29KB
- SHA256 afb5de202275b56fd3f692015b0ce44536db0db7659d392f9dc94d58da87c8f7
- MD5 ffa2e5ab3b36f5f9ae74cff2a038c1d4
- SHA1 8ed7f9cf5089d8361dac06205f5d4567dd8006f9
- SHA512 4775cfe9550daa79fae22c204b118bffc293059110250456b69b6539594d0d3dbe7dedec6cc53aea1890d88340489a993312f0d887453d3702f8a12c7cbb2492
- SSDEEP 768:FiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNboE+ITu3i34vfF3if6gv:FiTZ+2QoioGRk6ZklputwjpjBkCiw2RD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\autC9A5.tmp
- Size 413KB
- SHA256 91242813006c5d4b13829eb58c0fafbd8db223f4e08c2b776a7913e81430d7de
- MD5 949169beca0db71049f399b967f83788
- SHA1 44521a34b25e346477e11b9a3e9263fc155d26d1
- SHA512 1439b96ba9a3641d9bc7c468d696c4ad3b216966bfba099a47ab67f78f0587b55628040afb62fb73b2c2fdccb443c4fb429d02f35c945069a2e348e4500170ac
- SSDEEP 12288:MDketxK2hZ5hIYNWAycCZ1kvF7qwXmeL/yLP16:MDkUv5h9YAu1uFp1LGP4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\autC9E5.tmp
- Size 9KB
- SHA256 7c548d6f2a8da0f0f6f446e3e50b2ee13b797a52322a5f2c603d5e1868655d02
- MD5 c800930f609777b6a62bdfb4e0f6d13c
- SHA1 25a5607ea6e7a54390ed56f9132c875f8f03a072
- SHA512 038b8820b95566a9e141f80e6cacfad70926b4e325c68ad0fef65f5fcd8d315421fb04465a4066dfc4f529a350c0cdb4f6a91c9fff6e28531ca2036875b4eaa2
- SSDEEP 192:QNAVEhj191yTkC7gbqUgbHFFe4qyed8kj3TTA2esYWj88bd4fdrrXTZ8q:QNAI/IkCqYrenyed8iA2AWj88bdw5XTp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\scroll
- Size 482KB
- SHA256 bc16cad3c5fcd0da9deb63a3ac44b660c6a979b1be970d526feff7cdae679f52
- MD5 d0d973e17f4f9faff0bd11e10be35a45
- SHA1 8f6f95ff9d4d5ec970e1ce58902122bd682d8828
- SHA512 2e34d179a064b44043350b80a44601a5732d5ee79b201ab517af64bd806a535550288f2d13c2e961e4ca58ef63a0009a5073233619f3e912e3643434e0520367
- SSDEEP 12288:96v7lNhsHmwqYXdhpA00BQaeW7ywNQTR72T4r8DMyMXM:96TZ1wq0hFieW7ydTEObyoM
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\directory\name.exe
- Size 103.6MB
- SHA256 aad19d6fd19dffbf4eb34191ee1583d335e1ae2b870f45d81c2c2699234c2bf9
- MD5 812b509162fd0cfa8639c0ec616c89cb
- SHA1 47402066529ec1ba780f0d35c87bfa06349f04d7
- SHA512 15736c7bc6cf91c816fc4e06ad7392ca9e9fd16c45014b7911eb3f39bac2b3871420967041b77cf92a21230c7605fdef606eb5deccd0a740288d4bddc8593d16
- SSDEEP 98304:AjTQYxsWRn21SiWwOvT6MAaICo2jeNfRkeNQ43Bm:A3dxfDwyGMAaICo2jeNpkgBm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\directory\name.exe
- Size 64.0MB
- SHA256 5c4e73229b88de07402afe5912a917d9210f5430c685385e07e3f96f3897c367
- MD5 c402cad57929e243c3e28c1ade94a387
- SHA1 7a1f9436c6dbd1c796faf22b0a69656331f95310
- SHA512 629ceb31a120701360b1c036663accd366b5f06f1152694465dd954dde7f09ab5adf3243d1ee28e02d8684447153a17350bf284669c73df04daf24595b73ccef
- SSDEEP 49152:ITvC/MTQYxsWR7aDSjB2hTSu5WLr8OvT6MAaICo2jeS8E:AjTQYxsWRn21SiWwOvT6MAaICo2jeNE
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\directory\name.exe
- Size 105.4MB
- SHA256 9cde38faf842c3c313144020889056f582c4236bcd0de2fbc1fec6d406a78abd
- MD5 0056f9f571a6d4505e4656120e52bb91
- SHA1 535ec115c8cb2c6d4df4fd559aea28d5db2c3786
- SHA512 0a9d0112fa779ce00b2b66812c982f2afc6718486db94b4aa5698193b6e8a8616d0b34a471a449121eddb88f98c425b7636392bb6c24acdf5570d8edac2d03dd
- SSDEEP 98304:AjTQYxsWRn21SiWwOvT6MAaICo2jeNfRkeNQ43By:A3dxfDwyGMAaICo2jeNpkgBy
- MD5 SHA1 SHA512 SSDEEP