Resubmissions
17-04-2024 08:54
240417-kt955aad45 717-04-2024 08:54
240417-kt9jlaad44 717-04-2024 08:54
240417-kt8masad42 717-04-2024 08:54
240417-kt8bjabh6x 717-04-2024 08:54
240417-kt7p1abh6w 717-04-2024 06:26
240417-g7dsashd8w 7Analysis
-
max time kernel
300s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
17-04-2024 06:26
General
-
Target
ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe
-
Size
14.1MB
-
MD5
ca8759c6ed97044b07af776617d63e60
-
SHA1
8d9c7a6ae0d7b04965881640f890fb824e17aa15
-
SHA256
ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352
-
SHA512
8c90dbb2d346c52d6c0a2a34df3fa4258c573df654a57e9a2d1304b55e770a18f9ff8d7c5006e9ec3e3890e27723516ada82d10429666d3985dabe6ce2166c36
-
SSDEEP
196608:zCKlOXcCT0AdpHeFsfghvbxyUPbHjTV2JOogd3dB3q91okxWeOZSzsvwQv/bUYLH:WSuQsoNxDV6oNr3qoL3Zy6wQvjUeWw
Malware Config
Signatures
-
Executes dropped EXE 19 IoCs
-
Loads dropped DLL 11 IoCs
-
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 45 IoCs
-
Suspicious use of SendNotifyMessage 45 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe"C:\Users\Admin\AppData\Local\Temp\ac075628b6cdb15172f6a76f0d3331316934e09cf0f0bd3a94c0e5e23b02a352.exe"1⤵
- Loads dropped DLL
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txtC:\Users\Admin\AppData\Local\Temp\CL_Debug_Log.txt e -p"JDQJndnqwdnqw2139dn21n3b312idDQDB" "C:\Users\Admin\AppData\Local\Temp\CR_Debug_Log.txt" -o"C:\Users\Admin\AppData\Local\Temp\"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c schtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Create /XML "C:\Users\Admin\AppData\Local\Temp\SystemCheck.xml" /TN "System\SystemCheck"3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {50DAF934-4B33-40E9-9554-461526D8B778} S-1-5-21-406356229-2805545415-1236085040-1000:IKJSPGIM\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe7z e -p"DxSqsNKKOxqPrM4Y3xeK" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor.tmp" -o"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Tor\tor.exe" -f TorConfig4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe" -SystemCheck801043⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Helper.exe -SystemCheck2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.7MB
MD58c6d737d2266a938b8e771b661005e17
SHA194c29a32cac2540ffd996a97ada23a14504441d6
SHA256f19a0113ff2e113dbb719a6851242aff2cd7463e9766eaafedc00cf3326513d9
SHA512fcf801bb69cd76d0f0507a37f6b121fe90d9539101df0dd54d8acc56bf37a2af1ef64067dc2a850471ef9871d350cd6ec61997ba7acfb88117f6a8da3a2270df
-
Filesize
7.2MB
MD5211f02e41dac48e00425276ecacfb4aa
SHA11f14aa92dcf21c82d20b953b42e18c46cf430dba
SHA256193276f5205f9e85066726c045ce1277059ff095ac21bc0801c4b95960898845
SHA51203e0bfb1cc8b09d3601bb5612622a4e79943077c22accad53d04fba441747bcd6ca2e58e3f161a2249f03bec84fadf3c1def263acc3be3ab3c8e5fe9a96c7975
-
Filesize
12.8MB
MD534c5a0f1e8e6bb660d79bafb4847ef3e
SHA192470fcb2e0b9cece22ad621e69a0767e002c029
SHA256bb683ad4e14fffa2b9e852f0d1a51eb0218798502962c655f98d68a1bc3cc670
SHA512c4d496de0463cb7795a43de43b0c89fd8dca5ef33e98beea01bdfe05f7e0c41328096a7e67913df72c7d086ae512537273ba05cea9847221cee5595b10b4e48a
-
Filesize
2KB
MD59160347bec74471e1a79edfd950629ae
SHA1c149a7e5aab6e349a70b7b458d0eaaa9d301c790
SHA2560fe356f3d04bb43f772604b049fd2b20f3038ca2ce84bf9778b8ccdd481d77ab
SHA512b8061834f658567a1e742496c38688bdecd60191a92163d47470f64aa1fba23e92dd36fa1d2bb7efa36f14002c0606013973718b9f107e62d845a17be4b0d358
-
Filesize
12.8MB
MD5c80b046f7570cbb66be8162691ec5cbd
SHA171f42723bc23f6ca62295d84f444f80e29794372
SHA256e26b37f53825e059fad1bd7ed23fed1bca84e1bdd65cb466bcd370e5340de4f3
SHA51284bc317c3eb8a405ba5793153d782a04073d42381304568f9950466464e127126bc206e928a2ba19d05974dfdd7ae3083663a73033b185eea6b4d5ac67c175dc
-
Filesize
2.1MB
MD56ae48867bcb34bc16a0ea4f839637959
SHA12434d05c23d4043d1de95cb6333aeb798f43d478
SHA256c55ea0658e6aecb71052e9fa4d35c17323f4e5bd238198938e0950d7a2af1586
SHA512d8ca0bcc4be36c26197a47d36051874e55e66bc03ac44a99429912aa13aedf6b6bcac8b0f903418d92fab7b52cd6ef5248437648501824393aa67f9240e45e36
-
Filesize
3.0MB
MD593e0510799debc05f25daf15478cadd3
SHA107858916f7cc3ecf0e559dde367d78275db68ded
SHA256df01f0bbc168a6a0246b57634a95f0fc32ad09cf2456090333bb5db7cce746d1
SHA512d958b421c197b01adc98cba38f20565ca42bcaa6cc51d92ea88ff284e4eb66f972d59a207449508cc1a8e47adee69fb84e60b0481b7a4d152aaa354a233fbc1c
-
Filesize
2.1MB
MD54cd3f07fef4d2d847f9cbba628e8edb8
SHA1bb901200c646be4bd215f713f9df9a965517dd13
SHA2563925bef7666a8c8d8d3ab3a15733f7b64d4297741006348d25a703c338389e04
SHA512cf0b29a45f499ed67ec639df591cd9b8ff592e91934d7e6957caaf6ed3c24b751a9885f854616bf3813898b73b253cb054f66540575ba3c19fa18c303de99e83
-
Filesize
2.5MB
MD5b57e3160f18f33dc9f69ec4ac83f8b0d
SHA1651d39de229ce63ff85fba1d4ba3408bd93d8537
SHA256c09d060e4f78e25bf6e27a6ac790871ac2eb87d8f18eb9f2dff8c7ac9c8d6330
SHA5124e00f998151d81c05325b3537c9a4ff87279d96a7205f267cd5c1cbe78f460aad82ce98c868d4a63c6dae3812810614f4ea340051dd646aecb5f67a5b12deff4
-
Filesize
769KB
MD56536e58d90b2e9ded05097163d81642c
SHA1ce1b8e8db12a8bc5de1eba1f25a02e4e2e9ac22a
SHA256e6093fe75346ec927fe3f0eb79ea0d331a3b0493267d488018c8693c9cef9252
SHA5128a766313525cd4268a27843daf588adbbb5ea7476fe0c2c33321ec2e5d9219d6fa335c8f8dcfbb073578631d032416d8ccf7bfa4a7fd89031314bbc981feefea
-
Filesize
7.2MB
MD58845b3ae6cbda2c34149200798cc8b4d
SHA1af0f9b43173b7306c477a5668b9c2aae16c03470
SHA2567572a434f38abdac2beff907359d20b80c6ecd970fef9ce5174c2d043f14356d
SHA51271fa2d30c0c836c653863e3afb57b293a85427a0385e1cdd3af69167672b4da47db82e221fc4e4dfb05edf059d8e5304eff55977c735f1e5962764bf7671be3b
-
Filesize
201B
MD5b9d2fe9cfa840518fa39039c928d4938
SHA10561516b7cfa784cf400349983817c8b18817256
SHA25669d57bfb46ef8097c1cfca65885790421d0e0965b7778f165cd7df9368807776
SHA512894510d39a044a37325d73b8348860960b3a78c54e7cdf81357f4b50e8dcf5d47ab98c768e6439949ba835802b2a5e98314441127d9655b027caf246e09e013d
-
Filesize
840KB
MD552dc140cbb14e2154e9087ecbc8cdc28
SHA168a2c92e99a283a67b898fd3208c19160cd36617
SHA256b946b94a6abec862e0685327f76f5f55ed690268c4cd3ceb4018acd6e0e12d6e
SHA5124dc2bd64cfcf4fce6f2030b2077df212da260d89505f16e71e1f06eae7d45437831c34e4de6c1d24ae0b02ca142e261eb363b495595cfd6e404d2304c403ebb0
-
Filesize
967KB
MD5286cdf5fdb6414f3e0508c446af62c30
SHA1394d333371cad5735f09ed8bed128448b1b965ea
SHA256481c13cf972fafa748486fbbd0366a44babaeabd19ba56e691bb3a064c653153
SHA5129ffe9f6d881df0b6a35e9cc7636b64097196102115d9451dd4db71d22fb37ccedfe32879952cd979f85247bb8168f9df95af18dc0eba478deafb2301a6b24c1c
-
Filesize
272KB
MD5606110186930c205e48942975a851ca4
SHA1d2b7a21bd55a035e2a7813eccc9e33f5f7815823
SHA25633115d4f22517c23939d8f8ab65bbb35cccb5d463ba81b44623e3cb57c8867f7
SHA5123b00c7fecdbaec3fced8f8ecb2b0351d406a3d0a461011140f60d9e1e52afcef3b92baa8c1079ce01716ba266a975c0f54e16f282bf4cf97fafa2e0164c0245c
-
Filesize
499KB
MD540a7215c1bd90c1da72b1d4e139f1821
SHA19106d6140ceec25059c6fd8bbead9005346c88a9
SHA256c115d1a52cd1e848969928a07dbc5312c53c10380bf44a7cdd82a31d5f37404e
SHA51211d1b8a704d02b413822a2bdf8f0c9ea4e5a72509484e1ce96033b226ffb6ef3bdfed0bb05ea3c2396bc7543d9fa0d1f04169277deeeb341186e2ae9de500019
-
Filesize
3.6MB
MD56b179fa8138ae6135d194f19c93e38af
SHA10a18edd6b76ff09b6132be574caa4502d8ef4d03
SHA256c3d44f93c33999447dc2c1a7197e14ad5278116a5c42b770e974c172162ce963
SHA512f84235149adbbd0b6bcd364b6692f772411e23db80559ceb193252e3e0b4d64de289bff82c23364e998c12168373fa1a5b625d5e85eb3e954f6d1f7db14f95b2
-
Filesize
105KB
MD57b7f33f2d84c9cfbfdd0f755140d2bbf
SHA198b084b1f3f2637fad742ce497659c052ce1e310
SHA2566d2c002ba600b97e0d514166bcf33667553f41fcbd73e2cd87baef74d4c6f060
SHA51266e8540a4da9c248980096d20a368458a221facb47a353907da636e39bbad9dd3fb70679b8d7cf6b1d6b3d0ffad3ac8b29148c9998fbdbdbb217c1597c839708
-
Filesize
722KB
MD543141e85e7c36e31b52b22ab94d5e574
SHA1cfd7079a9b268d84b856dc668edbb9ab9ef35312
SHA256ea308c76a2f927b160a143d94072b0dce232e04b751f0c6432a94e05164e716d
SHA5129119ae7500aa5cccf26a0f18fd8454245347e3c01dabba56a93dbaaab86535e62b1357170758f3b3445b8359e7dd5d37737318a5d8a6047c499d32d5b64126fc
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
668KB
-
Filesize
132KB
-
Filesize
3.7MB
-
Filesize
292KB
-
Filesize
756KB
-
Filesize
936KB
-
Filesize
504KB
-
Filesize
2.0MB
-
Filesize
668KB
-
Filesize
3.7MB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
2.0MB
-
Filesize
3.7MB
-
Filesize
756KB
-
Filesize
132KB