Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 20:35
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe
-
Size
11.8MB
-
MD5
f5710bcdcf51bf465e39c7cae9de6cb5
-
SHA1
e0facbe97030a8d9492a5c6250f6b6c7e876fe75
-
SHA256
ca5c6e61ca4cbc89d631b7458004c13214b4f65638265448bc7742cc1681e77a
-
SHA512
f63abcf8d6ccd9f7c23e92d088fd11bbf55e3a3e1c57d1bf5b8db39b7f00000809ad5c3c33b17bb1688b4bf870979af05865e0a4e86eb08aefd6d6cb946a3a0a
-
SSDEEP
98304:x1J/vWGql+sY74O06XIxz5jDV82YGkqB9b41FZWO6Yltm8zQHW:x1J/Nc3wIxz53V82YGkW9cZWnYltpzp
Malware Config
Signatures
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\setwall.jpg" 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe -
Drops file in Windows directory 10 IoCs
Processes:
mspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exedescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exepid process 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exedescription pid process Token: SeDebugPrivilege 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe -
Suspicious use of SetWindowsHookEx 40 IoCs
Processes:
mspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exemspaint.exepid process 2592 mspaint.exe 2560 mspaint.exe 2972 mspaint.exe 2144 mspaint.exe 2744 mspaint.exe 2312 mspaint.exe 2708 mspaint.exe 2288 mspaint.exe 3036 mspaint.exe 2580 mspaint.exe 2288 mspaint.exe 2744 mspaint.exe 2312 mspaint.exe 3036 mspaint.exe 2580 mspaint.exe 2592 mspaint.exe 2560 mspaint.exe 2144 mspaint.exe 2708 mspaint.exe 2972 mspaint.exe 2288 mspaint.exe 2744 mspaint.exe 2580 mspaint.exe 3036 mspaint.exe 2312 mspaint.exe 2288 mspaint.exe 2744 mspaint.exe 2580 mspaint.exe 3036 mspaint.exe 2312 mspaint.exe 2592 mspaint.exe 2560 mspaint.exe 2592 mspaint.exe 2560 mspaint.exe 2144 mspaint.exe 2708 mspaint.exe 2144 mspaint.exe 2708 mspaint.exe 2972 mspaint.exe 2972 mspaint.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exedescription pid process target process PID 1900 wrote to memory of 2744 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2744 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2744 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2144 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2144 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2144 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2312 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2312 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2312 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2972 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2972 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2972 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 3036 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 3036 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 3036 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2560 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2560 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2560 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2288 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2288 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2288 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2592 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2592 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2592 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2580 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2580 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2580 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2708 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2708 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2708 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe mspaint.exe PID 1900 wrote to memory of 2712 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2712 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2712 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2724 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2724 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2724 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2736 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2736 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2736 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2852 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2852 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2852 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2604 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2604 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2604 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2600 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2600 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2600 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2696 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2696 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2696 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2460 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2460 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2460 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2660 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2660 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2660 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2648 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2648 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2648 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe explorer.exe PID 1900 wrote to memory of 2836 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe control.exe PID 1900 wrote to memory of 2836 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe control.exe PID 1900 wrote to memory of 2836 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe control.exe PID 1900 wrote to memory of 2684 1900 2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe control.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe"1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\mspaint.exe"mspaint.exe"2⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\explorer.exe"explorer.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\control.exe"control.exe"2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1900 -s 7082⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1900-0-0x0000000140247000-0x0000000140249000-memory.dmpFilesize
8KB
-
memory/1900-11-0x0000000140247000-0x0000000140249000-memory.dmpFilesize
8KB
-
memory/2144-10-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2288-2-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2312-3-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2560-8-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2580-9-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2592-7-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2708-6-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2744-1-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/2972-5-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB
-
memory/3036-4-0x000007FEF65C0000-0x000007FEF660C000-memory.dmpFilesize
304KB