Analysis
-
max time kernel
150s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
16/07/2024, 06:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
senex_wooferv2.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
senex_wooferv2.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
senex_wooferv2.exe
-
Size
547KB
-
MD5
2c34ffccadf1e85664f1d6db4f382ec9
-
SHA1
650a97552b8a88910974202348041611e5f597ab
-
SHA256
e5ba880ee68d3dd4ec9dd98a72fc368e14dc0f31a0c05e06acde6f4a6f148d57
-
SHA512
66f9c57d1b377178713b415f728c8df3da22886978f2c7fd037c953dd83ec8caef91b2376e4341ab3080412ec8826fe063dd1b560062531f70826d2021021290
-
SSDEEP
6144:A2M5jRQas4PR8cXTvBOoTWly3csKcW6JUBQE3Ko3MHOVnWuOBD4LXA:A2M7PR8Iak3cPsiQCSp
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 2 raw.githubusercontent.com 4 raw.githubusercontent.com 8 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862 senex_wooferv2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\senex_wooferv2.exe" senex_wooferv2.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\shell senex_wooferv2.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\shell\open senex_wooferv2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\ = "URL:Run game 1084115737125322862 protocol" senex_wooferv2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\URL Protocol senex_wooferv2.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\DefaultIcon senex_wooferv2.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\shell\open\command senex_wooferv2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\discord-1084115737125322862\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\senex_wooferv2.exe" senex_wooferv2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe 2508 senex_wooferv2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2508 senex_wooferv2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1060 2508 senex_wooferv2.exe 30 PID 2508 wrote to memory of 1060 2508 senex_wooferv2.exe 30 PID 2508 wrote to memory of 1060 2508 senex_wooferv2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\senex_wooferv2.exe"C:\Users\Admin\AppData\Local\Temp\senex_wooferv2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 12⤵PID:1060
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b