Overview

overview

4

Static

static

3

AnyLoaderV3.5.exe

windows10-1703-x64

4

Analysis

  • max time kernel
    133s
  • max time network
    135s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/05/2024, 01:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    AnyLoaderV3.5.exe

  • Size

    24.5MB

  • MD5

    99856c427b54bb791c179f01c6cdea18

  • SHA1

    fc3171c550e54c1d0f6910a608d1b9ed57d7509d

  • SHA256

    9db19f13597439dbc546601d2e3824641b301f3d4a6b56fbeec902618c439850

  • SHA512

    7a596bb93673cbe71febdffaea874c9c49fe6073233f839fd99409e74a9e45dddad8906e705b0993e7dd128be71881fdb2b2482e91587a14f4e00a1ee447fe40

  • SSDEEP

    393216:G7SZr9mc8QllDOfkY6lrzmGhqNcVjKtZELNwUhiUbA58wlRZHl6w0XCWg:G7+WQlNOcbaNQjCELNlhO58wj6q

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyLoaderV3.5.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyLoaderV3.5.exe"
    1⤵
      PID:1184
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4636
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
        1⤵
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2176
      • C:\Windows\system32\browser_broker.exe
        C:\Windows\system32\browser_broker.exe -Embedding
        1⤵
        • Modifies Internet Explorer settings
        PID:2916
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4564
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3412
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Drops file in Windows directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:4044
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:2644

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DFE26424E85D265E9E.TMP
        Filesize

        16KB

        MD5

        c112f948f73929757109ff4c6e5733e1

        SHA1

        c7046b426fcbe9d9cd27dce4321bf9436fcb79a5

        SHA256

        86f4932684260f624e7527a104fe6cc2c9467b6346e17de2a07c2e43fe405a11

        SHA512

        eea89b4d0a5b9277ff6738a93adb4b5e74ec073d5ef8beb2faf0927a91e7b211e55737388f0a106ed46c5562072aa9e49f41fc5fbd1816e7be242bdbb6b11535

        Download Submit

      • memory/2176-16-0x000001FE45320000-0x000001FE45330000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2176-0-0x000001FE45220000-0x000001FE45230000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2176-35-0x000001FE443E0000-0x000001FE443E2000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4044-58-0x0000027ADD800000-0x0000027ADD900000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-57-0x0000027ADD500000-0x0000027ADD600000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-54-0x0000027ADCE00000-0x0000027ADCF00000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-63-0x0000027ADDA00000-0x0000027ADDB00000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-88-0x0000027ADDF00000-0x0000027ADE000000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-110-0x0000027ADE100000-0x0000027ADE200000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-130-0x0000027ADE200000-0x0000027ADE300000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-109-0x0000027ADE000000-0x0000027ADE100000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/4044-52-0x0000027ACB900000-0x0000027ACBA00000-memory.dmp

        Filesize

        1024KB

        Download