Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
16-04-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
MCBEPlay/bds.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
MCBEPlay/bds.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
MCBEPlay/mcbeplay.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
MCBEPlay/mcbeplay.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
General
-
Target
MCBEPlay/bds.exe
-
Size
1.1MB
-
MD5
fb17363726f7014a1ed0bed91a934755
-
SHA1
c43b1066d680d47ddf51098f41fa70695bcb50be
-
SHA256
03cb8b62b0f8dbad03877ff5a2da265d1df64191e37d7773f5fe54f32b267bf2
-
SHA512
7aa17ae7869496d98a58f64ab515fdeee6d40664c4d4f379ffa9a120347df694e86e0997fa43377c84eb18a5689e4d2a5cd04c3df00d31a683242e8a2c9137e5
-
SSDEEP
24576:IRaZROMOm8FN7TjsPnzt2heeRhQbJEOeamWbm2uGQBi:mkxOm+7TjsPnztyDMmahVQ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe 1712 bds.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD549cde9fd3a1a7f56234a742ae684f94e
SHA1d9e7be73e8d973362e417c8e2613296890146987
SHA256b259569c2635ed5a30240148179a11856c2b3e78d0a59b2383a3816123f883a8
SHA51219f88f578728fda7cd2b20e9021865a176cd2c07bc9f42eb3e7a0454e0bf78c2adc357de28077c895fbc5c537d101c11577c479e865124a87e4270760239139e
-
Filesize
4KB
MD5ff135995b3cb758b6248ac0f5cc4602c
SHA11b7ac52279ff6acff2f149b3d9867776813c63ca
SHA2565f5b4ac3433e5977c7256c55adf14584a629b6294ce6e3179ee3eb371a8feb78
SHA512cf1e8ec3ac5420c8eaf43e5cc9d92fcf2352b784e74360911c7eaa879190c8dd774d058e34b1b5f1b4d3be4dbd63d8cbfd1565b9787893728e340e447ba73526
-
Filesize
12B
MD530ff4eb15654645e6c94c61ca7c74471
SHA131dd07f46f5ee5fc2fa4c5edecde244a0c0ac6ac
SHA2568820e90d8def683903563d1300ccea1c7c0e94c572af1a2622a5310474b42eea
SHA51260f119c2fe2d36b12229c2bd0a253b381343e98d8c5fa827adc813b360cd7134d63543801d4f96b2aa41a391846a08b84bb9f5055a4668af904518612d40561c