Resubmissions
18-05-2024 04:34
240518-e647raca7y 1018-05-2024 03:15
240518-dr9cgshf31 1018-05-2024 02:50
240518-db116sgh24 10Analysis
-
max time kernel
124s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
18-05-2024 02:50
General
-
Target
IDA Pro 8.3.230608 (Windows) (x86,x64).7z
-
Size
318.7MB
-
MD5
211af170bc614586b519f84016371947
-
SHA1
360c884543126771156d1350d1cc49fb10d2ef34
-
SHA256
6287c1d00f8e1777bd47c273c7dea2438321a5147aa0b9d722a8671718701cc0
-
SHA512
1145cbb8be6979a083d28593c99dd43d48a1506e576304a2eb19dd4f0cdf86e442cc97b5560d46f22cfbf707e713b2fd097830fab117258554f19ee2add5e821
-
SSDEEP
6291456:nrGwUH5LKNEc1OcBQHItZlEA63n4kPqJOrjkXkAJHnT8EepsclNjd/b:n/UH5LKivSQQEAaHqJOrIJxngEe+i
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 19 IoCs
-
Suspicious use of FindShellTrayWindow 55 IoCs
-
Suspicious use of SendNotifyMessage 54 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (Windows) (x86,x64).7z"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap8754:132:7zEvent117211⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\IDA\ida64.exe"C:\Users\Admin\Desktop\IDA\ida64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x4b41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\IDA\idat64.exe"C:\Users\Admin\Desktop\IDA\idat64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Desktop\IDA\idat64.exe"C:\Users\Admin\Desktop\IDA\idat64.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Desktop\IDA\ida64.exe"C:\Users\Admin\Desktop\IDA\ida64.exe"1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5fd80d43e803c146d0718b811e96ef21b
SHA12d53fc58d9e752b9577fe1e78ac117d9d0703469
SHA256695307903ccc11dd4972015bebb160b7f0ba414a95e8323e5788476e69e3f83c
SHA51201c8a7c1b5fe6d752e237837e448cde3d52888d3d3bc2185bbbdd11557b512f1175ff7c2d3260cea7c7600f6ff263c730d7149fea25f334817541782eb3c1c13
-
Filesize
6.6MB
MD5367ada59863dde5902ac813c765c718b
SHA11c30b98f93d5fcb49a15ae22ac9ab1792a0cbfa4
SHA2562b8df2fa3a3f75be898ad826e3698a562cd3cce71096ce0b0abf362be6ba57e2
SHA5127d57df5c3a9d7de2969074a4ef59cbca6d51fa84de1bc76d5fa4e633b6aeef9f00351ea1774b67ac3565ae6c48e18f0e561487c60027326defb166f3229db057
-
Filesize
309KB
MD54cd655f4d826e8437b0415aa6c8d6550
SHA17611161c774c7c72b189b420772d2c65e2634e4a
SHA2567b105ebf20c0b52259c00ff645f95f584bbe60b91c90de583785ac88b448e26d
SHA51282745e4139f72f6843d0f4b588c2744b60a405e398f158319ee336758c09abfbced2f0ecc4e0a6d3e535384a9cbe69f89935b11a9b5857cc8f7deec00f044c6d
-
Filesize
324KB
MD5f3cd456d5fb9685304dbb53cc7b9ebaa
SHA18eadfaf8b8e8df16fba9e1dcc36d0ab3eb6c9f42
SHA25662089b5a811c7c0cc408335dbafa0c7060cc9324c01595e011abd6ac2e868442
SHA51203c3c24a95042b5e4337f2e093d219ebe3a3a05b8a78a8029550f1470c51b4433a60ca7d1000e238a3bfed51b6e6b112788a0663ea6618b4d052214749b4035c
-
Filesize
5.3MB
MD58b786869feb36930f8d6fd7be98ced2c
SHA1f6fc979919df931af8fbeae54eff502663b2793c
SHA256af337b316a39107944bdeb117798fd8ce02c3307fb415a371b6bc431d470a3e5
SHA5129eaa2390abcceb7d69958be99c75dfd60edc464ea8018d3657a39846f40ecd6c6e48bfd750c48264047cff82b6aec398f63df5f70f0c95484a052913e845384a
-
Filesize
932KB
MD5024b0555d7a5740272ee805b0f32ea8a
SHA1c48488c4e525f9f8a2a1cfa1cbab42698c1c67a5
SHA2562291a8037a0ebba9b9f63b34af0d4cc43402a0cacdcc3cab27d83bb3ddc6025f
SHA5123d4c4ec4c2c851b353d4f17f102c1e8ee22b93822c99655d94ffa781572de58ab5253c638e116924816b85ab55f473f17b2a85cbf2ce159278033dec9840047f
-
Filesize
4.7MB
MD50b3c6dfcf57281ae74f12329af23cdbc
SHA1fb0239d88be8f5b8ba6ba8d9a31b1b3ed53ed392
SHA256d6435627bc2668b3571f5ee1f9beb88391af4a8d88d7e1a09c4c466cb5a7bd72
SHA5125d64819938c4bec3188c1b361b755375f9b94c8076efed9958434e3ac94eb00847fbf264129592497a3f58a1d7f445325be3f7f3fee30d919b8549c4b11a7a53
-
Filesize
4.0MB
MD523fe02467fb05b85cc78bcaaf1b015da
SHA179399bce20c07e0845197f4b5ef3d2a2d780ef6a
SHA256c695b8de0b3cb3b152890625ec3e0495bad2cd1b257c89de3169b35e3d67b44c
SHA512cb38da2a0366c73ddcac2a7024d302b80ecb36e5d4dea4a161e468e989e94b8db31cef8326a6a4837a7e3ff59808bd90829311431007aa93b5a521490a1b1c63
-
Filesize
1.5MB
MD58fbe42d205f4f7f36b5da4f7909868ee
SHA1bde9d1b0b9c3e387339bae9d99592ecb2f2f9a58
SHA25658a554b08bfc98042f7bbe42e2cfc7c19e1cd2b4957632bb9792719903567b76
SHA512b799eec49aaa9fb8ee7cf7bb5ff516636aadd25f4e31f34283f44e8af0411652814f7d3c46db4be2bb24aada5e0bc129481d8919ece7797058d1eb6d18bad539
-
Filesize
303KB
MD57a35fe7e93d9326b7274cdf5785bf301
SHA1050b1f071db96d544b84be5f1eb068cca02b3928
SHA256477f87e0736cab14a40c15c4315cd7d01a2cd94cf497729ad58f8e857932077a
SHA512a785284dbc0185135d3987ef7c3fc7f5cf940acaf578c85f8e01f11436895c296458adc95dd926404958fb6f75ab0556b601c43a13a99b7727d3dac1d0afce71
-
Filesize
177KB
MD52f24e118c31576d35869a81f60e59535
SHA1ad98a09729a8dba6ca98c5faeeaade8503c156d6
SHA25601aee797cecaaf0ed0db8494de0676c24213364281efaf7371fda06757156308
SHA512223d07a783e7c67ab9196557e2b599fa48e37767f5b0eba98f68a90b0d0e9fa26e0f13bd31a135a4482f40bb8d1f1cd03e4061f22d570a49ae45cb4eefe1c26c
-
Filesize
130KB
MD5bbd4fc0158e35417ee1f78c1e12700bf
SHA1f1fd4f5b58f49e09bb17339db33784aaef1fe3bb
SHA2566e54a71a5bede53c4962c6b8b83da631ef869360acbbc6297af40729c285e7d4
SHA5129be8a400cbdefec6dc70430b47462eeef3db588d16a70e2a2e7dc37558ebb5c98264b1a7c97885c309ebd5a364d570c55d0678d1c3165c2bcfc47f0517c46ef4
-
Filesize
20KB
MD56e2c9591ad675cc8e4c4ecec88585318
SHA1b280878bbc204abb6ba65496d094596d62c2edce
SHA256d2f2975ee507b2280dc44e94ff25363d609a6fcec8807bc93d960e75dfd1b995
SHA512f7de2ef65795368c4a70eff8fbd2ba330da2c62d0f645fc79ccf6ed528435756d2ef3d8f13c9e1423b150447283988b639a2df89491517cb1b174751e284128f
-
Filesize
299KB
MD5e443470236794b8f9dd453d625df1513
SHA11058b03ef229f50ca766622ef667869eb4df9242
SHA256519daf3c9e61f9f558551568eda3855e8a797f931c70eb3424da1e38e59f0ac3
SHA51268b5c96c9e964e179256ab5ef438072688cbd748769362374669b316ef1c2247de1752763ecd84061a942c0abe59d2c04fa87ec64f78f0dc51f5488cbf268580
-
Filesize
12KB
MD56bcba2ec458894f0e70fb2463229f02b
SHA174f045bae2b4dea027a0d7ff418776bf616fc247
SHA256aea8a36cf29a2ac986d5dfcf2d6d34fd31c503079c94fee11082dcd75c8991a7
SHA512719f8b396baf5abda4e9e486beae6279e00636364a18e23ad8e4f3e8eba927c663bf3dc8cba6abcc8cd15e2fadca5d1b618ac4a86fc45a0134a1d33e49a2d358
-
Filesize
25KB
MD5474c457220078356a8599f6d00846154
SHA1095dbced2fc4acf371bd9c1180a504c705a6013a
SHA2562841e224c0096f3ec4ee642d2e8e2a9edd06e2acd06d12329340e7126eb062b0
SHA51214483d4fc2847615998ab88c1c5b1351555d823f4065bdd392bba4b738a90dea7f0c68552161cc796601c3176d3972cfb067eee8fbc33e9ca698f885328a4afc
-
Filesize
318KB
MD5c6325d285b404efd9c2cf33f1296e5d6
SHA19b32fbda552e32d8ecb3b0fe4fd31351c5057cf7
SHA256075d0980ff735a21788d897ac1b83df9d0f217d148dd58b4a0b43be011b80813
SHA512fb6598e75946eb84a89b5eeb5bce0a4d8720c374ba6f4113665771aa9c3c52c04798e2f5084d4418532cb6a43c02f36cb405f67a6bc943d7b65afdfe783869ad
-
Filesize
64KB
MD597c1adb970a49bfc88610f3d8a368f59
SHA18e9637acd5c92ab1dc7e719ef68d2c4a3e98c10b
SHA25615e1ad0e44e053f546fe9d2da2ac90eedf0fccbf4bbc401dc33cccf58c7ca651
SHA51261198817f8e5255d01951c6671e194199f2a5c82eed988a175ac31a7f1e6a3f673556b38540610ae74203475340a349852e5099a8fd321a818e680a12d4594a3
-
Filesize
88KB
MD55c49a3b0b0afdaffcf7199ae0718e690
SHA1285295513989f2c35ca4da8d1194f87b6e5c4a33
SHA256cc0233b19f6e12f09c73d1c079184d713b1dcbe97de024887b944a1eebd174db
SHA512c5c76c1a4629deb8c67f12d9d92cc0c1c78ec952e3b429f2fda95dc412d4f448ba606b94402e42f84006f09ec66e14020a53845c8da0654502681179e7356af5
-
Filesize
548KB
MD550861c8892d58f9a9a5fd67f1de44ca4
SHA18817cb52146f0f4829c05c5d332e5cacf503b027
SHA25639c2b63000eb5a36ecdfddfb4cfd896437afe3fab754d5eb0787ea0754ee7202
SHA51236c2e4c04bee7fd16c437ec338b6a790e3b35be4c0836925d57a924068f747a65545530a24677b7e9c4275012c17072001a95213c6f03ba291d564be3f8bd98e
-
Filesize
135KB
MD597a05a036270dc5a725159855335fde4
SHA1d88b6b4cf620ef115cb114399224508f0df78293
SHA256473af36dfadca688a7b3be8bbb566d04446c4b3d8a4faa6c43e452738843b251
SHA5123dd26e3d1627ddd2c3eab991201711a066b780bf55967e0d2136290285ae98314c232ce4fd15d8ae5e3dc00e9f874f0668d606a06861c3b7410a1e6ca5d059e6
-
Filesize
277KB
MD59dbb935748d843f8c65dd1cc2fb4d800
SHA14191d51ed094ea937078627dcd0840d4f2057115
SHA25626c4cf041ab8f621e47901906d11fe46e8ebdb756c29406af857685f04d2ab20
SHA5128b35fe418b9f59a60ac50372a7bc8b78930837048914578ff667b5e425243d4afa07a7d3d3f1a8c3fb5ed550b5fdfb267da87374d79b29bdf3ef57a1ad26a7f8
-
Filesize
86KB
MD5c587191a91c2450880ccb05436cbbba4
SHA1fcbc6d4dadc67900c066c137144c07e1b85381a9
SHA2567d9e5e711526623958f45fb193b39f43995d51991251546f8b66ac2a7dc97606
SHA5129fc2c51d028e11daebaf6b085773cadfb10e4aa653fc793e5a5cce5d69327aff7304e38c4174a09bd39c232820e20e1653f350451bfc910181297ceb852ea662
-
Filesize
35KB
MD5ed973fa567bc9c2b14ce5be86679f08b
SHA131f66ade30fddb3be4bed51bec2358f52acedd03
SHA2562766cf3d89a52b10b8b3432b3a0b991a9a4b36a127bf00ee7cde995a50c46fb0
SHA5124392c9d8a941e7a4d99f76a7f4572da43808141e57c3cc09df32740c6cd947e58de74a2db8b2ce9923b11ffa961fa1eb792b830ada5d797ae0ea7e746668fda1
-
Filesize
108KB
MD514a7175bfd847c4ebc8433722cd069d8
SHA1c9d3f7b5b392aa18ceaa24bc08a6543cedad63dd
SHA25671825fa1b53312d6d5a49a1c4aeea4983315850786bf85653a618e70d1336d38
SHA512b8cd1e8fdef040a99a9eb27a2bf9abd218063f323653b9038aeeddfa8aaa00ec2c821435fdea9e81dbcb27563a1becc2dbff055435cfab531c5653b870e9944a
-
Filesize
32KB
MD569c91874901919939fd596b09ca4885c
SHA15d328548b7457d4a60ebfa0b1baefacded626db3
SHA2562580357f70041ba91a0da045e74bba8909bb1bbcd85e65c941bdc0ea38176bba
SHA5127ede554c246d000e7e3a793cfb4319c9877d9e3a49eff81ca47e44df4f3ffa120ac7a34b15c8e4fe1229616934cb1042e621f53ce5016b36567be4c8ab6af153
-
Filesize
405KB
MD52755b62dcd497e2b2caea16e49c231b4
SHA1930d1432c58ea717d058369a63f4e49998af8b29
SHA256ac85edeacd9d45beb81101c47120c3828d8d62b5d19dbda926466efc18e14261
SHA5121df860d2a95e205f916c0005405cebac3b9c779abb7e748688ec14cd21cc2e49e31db46d53b03c131b9d1ba687de77d1876a5044ba4e4b80a875ce4d3e48d5ec
-
Filesize
25KB
MD510be44153141b7f342a98371464e9327
SHA16d2b21d0a28382d85a1872ca964c0693a3caff0d
SHA2569cc9cfb7db2cbd70e199c32456186e7ded266fe30e450207387494101a44a99b
SHA51205c615b9866c63bf56270e844f83d0feb6483b38bdb1f6ad0b3f56070c6b29a118bf78711f9256d3b1c5ee20292d88332f00b89ec9a6e943ba2c80f108385f63
-
Filesize
1.4MB
MD5d806c1f1e1ae1f2a4481d15d57035d19
SHA1bd3b915558020550736946de5c06cb635a706a0c
SHA25649f621f2e5a8b3907099ec0ecc65f3519a5105b8446d7ac451a0ad7359fb7d22
SHA5128df43f5da8dbf6961b2f592e2a1fb2b5ee279b44129a6f732e932d00e41eb7ffd083e5013a33860a791a769282011d23e86196e0a85a207b46afe2d7ed07a341
-
Filesize
4KB
MD5f69ec7d00578dbce648edbbfdb4f296b
SHA1cafa50ea8ce972e3772876c19aacdc81ab42720e
SHA256421e951db259414aa04704972c14eebdadbbb3309d21c6cc72c00d7da3ba4aa5
SHA512e91ad97977307341049dba1dea8ee1c9370224a702792def65cf7864d273b193739ae13f519bea35879c31d1ff769279fd2aeebc3c891e2470d0c7c913b14855
-
Filesize
136KB
MD532e85e3303bb5675747fef26fc744089
SHA1f5b5a1c9834a244ca73368c3ffda1e7aeed1dd04
SHA256b7bb8a6ce946cd9fd74644aac3152ee8130875201ff174662a7f5fc28d1588ef
SHA512413c5cec9a198bc43769fa33da7843ebfa4e73d676132d08c8ba076c37477c2c4cdb2cf2ef73905bb805d5348577e61187bae6ef61227c104703f00a193e99f0
-
Filesize
2KB
MD5659c59af4841ab542bc5ae43abe187c9
SHA1838206246c95a4b673408c78fc6b294246d53913
SHA256618cdf56d2935c762f32b9c73e5e998ddc471f5f70c4c5a980dc22386e898279
SHA512e88d5cba70a86aee598d14305eb92baa9f22ba3f0c06ef108334f663413ab54c8a6dd9e57b13a31834a8e80cb86e455a97bfa806a1697ea39a639dca79be4aa6
-
Filesize
548B
MD571014d6369472d3184315f736d945afc
SHA1375858f197d1403c191670a3151ea51329ee75cd
SHA25632bd356bf7687853a140d02a5c9df551bce86656ea6cc587161887be57dc0edc
SHA512be351c9c6ddbfc23dc0bc1791321c066d250ade7ecb393e4b17ea9357810db368065ef601e7d469031cdac710bda8e824d55c7a32403d269084aed93ee4f9e6d
-
Filesize
212B
MD5b94a2770e638de7b863b8edf907e9b1b
SHA17ffa722fc4db9b413f9a2364ce8dfd4afcf678de
SHA2562b946593df3a65ab7d2bc4d5ab26606a829260de2b2441299e1bbcebc33f4722
SHA512fad27a4cf44b45e39fa2d03a5fd9ebb8c4119ee00d3d0b58cc712492a3b5d1fac31cfd02480b7e2249eddb9a3cf873c1fa84c531242d00266df69e7dcd15fa44
-
Filesize
35KB
MD5acc0c5c4213f7c376fd4fd82006882bf
SHA1329edc4045a01381d7dc3f3c90304e130c5322d7
SHA2566d673709dc4abfd2c1c6699213d55c521bc91420e420789e0e3672071e9195ab
SHA5124147d570a14c055240d43adda9858c285077e00660b7d06548c12f4983c773ec23bf69b36ff88986ad63d1d403f19ec51d9c8ae22c88b544d3503433d17542e1
-
Filesize
9KB
MD5d9d5e3099c39b18ba9b60093ca2c0f02
SHA1fb37de4a3302550acf8fc300dcb6e8914d1e24ee
SHA256c7c0c39c5bb03d6689cbb4067787cb59327d2c065c736bde7eebd14ca2ed95a4
SHA512a744442c01302727d4216e4176d29fb01a30e9efcdc9cd67b98bee280e069a6822894ec2ffc9a8a0efcf8e2373ed329043c73c0222979539ef634251f46c4c29
-
Filesize
4.0MB
-
Filesize
4.0MB
-
Filesize
5.3MB
-
Filesize
4.0MB
-
Filesize
5.3MB
-
Filesize
15.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB