0d9fcb8894240750cb5e4222ea78572aba6618eb5297c2069588ceb979d52d8b

Submit
Reports

Overview

overview

Static

static

0778d2ae60...93.exe

windows7-x64

2005110ee8...24.exe

windows7-x64

290072a9e1...51.exe

windows7-x64

3998d0e987...7f.exe

windows7-x64

435844f4e1...2b.exe

windows7-x64

495fbfecbc...72.exe

windows7-x64

542c157186...88.exe

windows7-x64

561d7f0505...35.exe

windows7-x64

617364875d...bb.exe

windows7-x64

6312ac9176...d8.exe

windows7-x64

63545fa195...8a.exe

windows7-x64

6555038a04...42.exe

windows7-x64

677393ff5e...59.exe

windows7-x64

680caf0e30...75.exe

windows7-x64

70192d461c...8b.exe

windows7-x64

76199c2662...6d.exe

windows7-x64

8727091cbb...44.exe

windows7-x64

91450f9e8a...dc.exe

windows7-x64

93386ea79c...b9.exe

windows7-x64

942bc9e43e...7c.exe

windows7-x64

ac7a29cb82...b8.exe

windows7-x64

baa851154b...1f.exe

windows7-x64

bb5ca9d8de...69.exe

windows7-x64

c15e2ffa84...07.exe

windows7-x64

c743ba0861...26.exe

windows7-x64

cfda742c2d...e5.exe

windows7-x64

d1d74ec103...34.exe

windows7-x64

d765e722e2...b9.exe

windows7-x64

daa41f5230...de.exe

windows7-x64

ed12ea76d0...0a.exe

windows7-x64

f062577b68...e0.exe

windows7-x64

f244a04265...35.exe

windows7-x64

Resubmissions

13-07-2024 09:54

240713-lxcvgawdmn 10

13-07-2024 09:52

240713-lv46yawdkj 10

13-07-2024 09:46

240713-lrz3tayajc 10

Analysis

max time kernel
718s
max time network
720s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-07-2024 09:52

Sharing

Copy URL

Twitter E-mail

Static task

static1

10 signatures

Behavioral task

behavioral1

Sample

0778d2ae6074545731b471360877b58c89ba0aaca6a0ffdb25694340c910cc93.exe

Resource

win7-20240708-en

chaos defense_evasion evasion execution impact persistence ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral2

Sample

2005110ee806a4fb40e00fe6c76af3527e3d66cd828723ee39529942812b8924.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

1200 seconds

Behavioral task

behavioral3

Sample

290072a9e1cf3872487cf586a592be534abc894d20ffd1121fe8338f1b52b451.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral4

Sample

3998d0e987accc2837c6bf87fdb2796d0170ae2a79383b78fd778531410e337f.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral5

Sample

435844f4e1a57fbfa40edf039ac0b29fab6c4115adbaba2ff2907c921a6aac2b.exe

Resource

win7-20240704-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral6

Sample

495fbfecbcadb103389cc33828db139fa6d66bece479c7f70279834051412d72.exe

Resource

win7-20240708-en

windows7-x64

1 signatures

1200 seconds

Behavioral task

behavioral7

Sample

542c157186bae766dd3e2df424e9c25251d71086b99cc9df121bc9bf50462688.exe

Resource

win7-20240708-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

21 signatures

1200 seconds

Behavioral task

behavioral8

Sample

561d7f05055800d3eb9d9e150969e2c84a71dc82a362fb3e1a224af420e53b35.exe

Resource

win7-20240708-en

wannacry ransomware worm

windows7-x64

5 signatures

1200 seconds

Behavioral task

behavioral9

Sample

617364875d331ab132bac1e63fb9b5a00ac5a33a22b93749dd6ee384ed435dbb.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

1200 seconds

Behavioral task

behavioral10

Sample

6312ac91761037de7a7afc7323671a004db71b31a69499178437bdf939fa9dd8.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

21 signatures

1200 seconds

Behavioral task

behavioral11

Sample

63545fa195488ff51955f09833332b9660d18f8afb16bdf579134661962e548a.exe

Resource

win7-20240704-en

mimikatz bootkit persistence spyware stealer

windows7-x64

12 signatures

1200 seconds

Behavioral task

behavioral12

Sample

6555038a04997404d48cf866ebb81f134082ef1613408779cf2a589068312a42.exe

Resource

win7-20240704-en

discovery evasion execution persistence privilege_escalation ransomware

windows7-x64

22 signatures

1200 seconds

Behavioral task

behavioral13

Sample

677393ff5efc9f6f050b4b5ed62579f2f050eeec53e7a17cb51c31c148546f59.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral14

Sample

680caf0e30b204544971d053b635ed0e3f1dee3332d9eab8a08b3f04cd7ecd75.exe

Resource

win7-20240708-en

quasar office04 spyware trojan

windows7-x64

10 signatures

1200 seconds

Behavioral task

behavioral15

Sample

70192d461c98da3d6d9734663dfee8d121b2739e9868f28b1fa67794ba3c9a8b.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

1200 seconds

Behavioral task

behavioral16

Sample

76199c26622c58fa0a22355d710ef06d86e3cce56def3d9a3c38ea395e48066d.exe

Resource

win7-20240708-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral17

Sample

8727091cbb89e5e31eeb2503ffaa242601c8840eee0973fd62fedf1b4b58ab44.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

20 signatures

1200 seconds

Behavioral task

behavioral18

Sample

91450f9e8aeb0361867cdefc0bb7e5bad8941b5081db549d34a91072df4db5dc.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral19

Sample

93386ea79c58a95c033e66da99d155264f0028a43973a9a4496f3fc8c89db0b9.exe

Resource

win7-20240704-en

windows7-x64

3 signatures

1200 seconds

Behavioral task

behavioral20

Sample

942bc9e43e40e01694365aced2331634257727783353c7d49d940abcc215a17c.exe

Resource

win7-20240708-en

chaos ransomware spyware stealer

windows7-x64

12 signatures

1200 seconds

Behavioral task

behavioral21

Sample

ac7a29cb82b7b3e50d8aaa0da5e431f0b466de07dad241e5b6090cf71963e3b8.exe

Resource

win7-20240705-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

20 signatures

1200 seconds

Behavioral task

behavioral22

Sample

baa851154b7492b20ea71c068f77e7e2b91d347fb97e5e05999af153e3fd0f1f.exe

Resource

win7-20240704-en

chaos ransomware spyware stealer

windows7-x64

12 signatures

1200 seconds

Behavioral task

behavioral23

Sample

bb5ca9d8de51734dbd14dc081c7c892d819cd14fafd7ccd62849d70f9e679369.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral24

Sample

c15e2ffa84d30fa17e9c61c19cde98b22ac6e259ec16b68a9927bed13a0aec07.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

18 signatures

1200 seconds

Behavioral task

behavioral25

Sample

c743ba08610d442531bb897a35748ba6fe897e730cea6e29377ba21141901326.exe

Resource

win7-20240705-en

windows7-x64

0 signatures

1200 seconds

Behavioral task

behavioral26

Sample

cfda742c2de7706171af64a89806656a107069e1677aa4ce0583e696f954fde5.exe

Resource

win7-20240704-en

chaos ransomware spyware stealer

windows7-x64

12 signatures

1200 seconds

Behavioral task

behavioral27

Sample

d1d74ec1039ff5aab99faf99bf70fb07f6b4c763a0c2fbc08b702ec9dcb03834.exe

Resource

win7-20240708-en

windows7-x64

1 signatures

1200 seconds

Behavioral task

behavioral28

Sample

d765e722e295969c0a5c2d90f549db8b89ab617900bf4698db41c7cdad993bb9.exe

Resource

win7-20240705-en

cryptolocker persistence ransomware

windows7-x64

6 signatures

1200 seconds

Behavioral task

behavioral29

Sample

daa41f52309815eff99483c87788bfb56b8576f15eaad42cd5b06bb3cf0cccde.exe

Resource

win7-20240708-en

discovery exploit persistence ransomware spyware stealer

windows7-x64

17 signatures

1200 seconds

Behavioral task

behavioral30

Sample

ed12ea76d03b8255f361975cebd5c579491dacc60c52e03373e7bf509523820a.exe

Resource

win7-20240704-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral31

Sample

f062577b6879fb42fbf7fef1c2a21f96d4d372f1424c1c77f255d13fb60bfae0.exe

Resource

win7-20240708-en

chaos defense_evasion evasion execution impact ransomware spyware stealer

windows7-x64

19 signatures

1200 seconds

Behavioral task

behavioral32

Sample

f244a04265405ae8295551a1324c6dc3162d611b4a152658096d675a31a57d35.exe

Resource

win7-20240704-en

windows7-x64

7 signatures

1200 seconds

Report Analysis Logs

General

Target

495fbfecbcadb103389cc33828db139fa6d66bece479c7f70279834051412d72.exe
Size

2.6MB
MD5

9756b1c7d0001100fdde3efefb7e086f
SHA1

55de88118fe8abefb29dec765df7f78785908621
SHA256

495fbfecbcadb103389cc33828db139fa6d66bece479c7f70279834051412d72
SHA512

d9497cd0af40cc3149db52aee1ba333e8261232ff00e6e7208eaac639fba533d6931828823c3c3211bddf083260904d77d595d877070eb218075b1f631e13f07
SSDEEP

49152:kNJLuf3HJrb/TfvO90d7HjmAFd4A64nsfJjogr1n3wSmZD1UCu5ErgXpS/IXF+9c:Tf3SvEoDY95e

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2528 wrote to memory of 2552	2528	regsvr32.exe	WerFault.exe
PID 2528 wrote to memory of 2552	2528	regsvr32.exe	WerFault.exe
PID 2528 wrote to memory of 2552	2528	regsvr32.exe	WerFault.exe

Processes

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\495fbfecbcadb103389cc33828db139fa6d66bece479c7f70279834051412d72.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:2528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2528 -s 220
2⤵
PID:2552

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads