Overview

overview

5

Static

static

3

2024-05-24...rd.exe

windows7-x64

5

2024-05-24...rd.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    124s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 20:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe

  • Size

    11.8MB

  • MD5

    f5710bcdcf51bf465e39c7cae9de6cb5

  • SHA1

    e0facbe97030a8d9492a5c6250f6b6c7e876fe75

  • SHA256

    ca5c6e61ca4cbc89d631b7458004c13214b4f65638265448bc7742cc1681e77a

  • SHA512

    f63abcf8d6ccd9f7c23e92d088fd11bbf55e3a3e1c57d1bf5b8db39b7f00000809ad5c3c33b17bb1688b4bf870979af05865e0a4e86eb08aefd6d6cb946a3a0a

  • SSDEEP

    98304:x1J/vWGql+sY74O06XIxz5jDV82YGkqB9b41FZWO6Yltm8zQHW:x1J/Nc3wIxz53V82YGkW9cZWnYltpzp

Score
5/10
ransomware

Malware Config

Signatures

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 10 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SetWindowsHookEx 40 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-24_f5710bcdcf51bf465e39c7cae9de6cb5_megazord.exe"
    1⤵
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4236
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3292
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2596
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3116
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2380
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1408
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1376
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3564
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:2564
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4960
    • C:\Windows\SYSTEM32\mspaint.exe
      "mspaint.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:3124
    • C:\Windows\explorer.exe
      "explorer.exe"
      2⤵
      • Modifies registry class
      PID:856
    • C:\Windows\explorer.exe
      "explorer.exe"
      2⤵
        PID:4944
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:924
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:2368
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:1188
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:2072
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:4872
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:1472
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:3576
      • C:\Windows\explorer.exe
        "explorer.exe"
        2⤵
        • Modifies registry class
        PID:2188
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
        • Modifies registry class
        PID:1276
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
        • Modifies registry class
        PID:4964
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
        • Modifies registry class
        PID:2492
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
        • Modifies registry class
        PID:3816
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
        • Modifies registry class
        PID:1576
      • C:\Windows\SYSTEM32\control.exe
        "control.exe"
        2⤵
          PID:2080
        • C:\Windows\SYSTEM32\control.exe
          "control.exe"
          2⤵
            PID:2528
          • C:\Windows\SYSTEM32\control.exe
            "control.exe"
            2⤵
            • Modifies registry class
            PID:3480
          • C:\Windows\SYSTEM32\control.exe
            "control.exe"
            2⤵
            • Modifies registry class
            PID:5092
          • C:\Windows\SYSTEM32\control.exe
            "control.exe"
            2⤵
            • Modifies registry class
            PID:3964
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3012
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
          1⤵
            PID:5128
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4184,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:8
            1⤵
              PID:5668
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
              1⤵
                PID:5744

              Network

              MITRE ATT&CK Matrix ATT&CK v13

              Initial Access

              Execution

              Persistence

              Privilege Escalation

              Defense Evasion

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Defacement

              1
              T1491

              Resource Development

              Reconnaissance

              Replay Monitor

              Loading Replay Monitor...

              Downloads