Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
15-10-2024 03:47
241015-ecgjlashrh 1005-08-2024 04:49
240805-ffygys1eke 1005-08-2024 03:50
240805-eee4jszepd 10Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-08-2024 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
General
-
Target
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
-
Size
70KB
-
MD5
58d6eab3aafd9139a2f1c7606ecd4cef
-
SHA1
4152a7431b3d5dd8b0f6ad08148cb166315f41e9
-
SHA256
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6
-
SHA512
ae92012d8401c886cb898ac0134db1567aaefb467d04d7afdb4e3e6b390b929dc353467d55b8cce5f3c74c942ac79ce565c172e296468ac44b3d8bd730a52c49
-
SSDEEP
1536:ZZZZZZZZZZZZZpXzzzzzzzzzzzzADypczUk+lkZJngWMqqU+2bbbAV2/S2OvvdZl:wd5BJHMqqDL2/Ovvdr
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vpmsyszwgqr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe" 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exedescription ioc process File opened (read-only) \??\K: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\L: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\V: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\Y: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\Z: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\E: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\H: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\M: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\N: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\P: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\Q: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\R: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\T: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\A: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\I: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\J: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\U: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\W: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\B: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\G: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\X: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\O: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe File opened (read-only) \??\S: 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exepid process 3404 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe 3404 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe 3404 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe 3404 02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe"C:\Users\Admin\AppData\Local\Temp\02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:3404