Overview

overview

7

Static

static

3

7fc5206a27...0f.exe

windows7-x64

3

7fc5206a27...0f.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22/04/2024, 21:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7fc5206a27de6c86a93f6a6d3918af0c7b850647efa8b279600c67f5b3b34e0f.exe

  • Size

    1.2MB

  • MD5

    90dadb3e75df9547aa5743575ca0dd36

  • SHA1

    d98780eba073ca35cfb6904deb88e19ba65b5a34

  • SHA256

    7fc5206a27de6c86a93f6a6d3918af0c7b850647efa8b279600c67f5b3b34e0f

  • SHA512

    c914dcbde55665e97ba00ff1bf2c941f57cfb881bab524855071bd83c310d4cabd4be1981b0443df555100998266a2c0eeb7eeee717fb39543a4da7c328ea45e

  • SSDEEP

    24576:gjFtxhQ1FWTiIskCM0oY4Kq+mLNa4yWYKhD28:gwUOzJoYhuLkXWYF8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 15 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 16 IoCs
    adwarespyware
  • Modifies registry key 1 TTPs 2 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fc5206a27de6c86a93f6a6d3918af0c7b850647efa8b279600c67f5b3b34e0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7fc5206a27de6c86a93f6a6d3918af0c7b850647efa8b279600c67f5b3b34e0f.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im TslGame.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2008
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im TslGame_BE.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1800
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im TslGame_UC.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2176
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im TslGame_ZK.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2188
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im ExecPubg.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2840
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im BEService.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im BEService_x64.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im BroCrashReporter.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2644
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im ucldr_battlegrounds_gl.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2652
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im reporter.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2632
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im wscript.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im iigw_server.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2856
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im Fondue.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2272
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill /im zksvc.exe /f
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2852
    • C:\Windows\SysWOW64\Rundll32.exe
      Rundll32 InetCpl.cpl,ClearMyTracksByProcess 255
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      PID:2732
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -ResetDestinationList
        3⤵
          PID:1172
      • C:\Windows\SysWOW64\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\eamonm /f
        2⤵
        • Modifies registry key
        PID:2796
      • C:\Windows\SysWOW64\reg.exe
        reg delete HKLM\SYSTEM\CurrentControlSet\Services\edevmon /f
        2⤵
        • Modifies registry key
        PID:2828
      • C:\Windows\SysWOW64\net.exe
        net stop BEService
        2⤵
          PID:2972
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop BEService
            3⤵
              PID:1680
          • C:\Windows\SysWOW64\net.exe
            net stop BEDaisy
            2⤵
              PID:2928
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop BEDaisy
                3⤵
                  PID:1688
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im 360chrome.exe /f
                2⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2952

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads