Overview

overview

10

Static

static

10

7a77a98572...f6.exe

windows7-x64

7

7a77a98572...f6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 01:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6.exe
  • Size 25.4MB
  • Sample240806-bmhmvsvcjn
  • SHA256 7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 32 IoCs
  • NTFS ADS 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6.exe
    "C:\Users\Admin\AppData\Local\Temp\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies registry class
    • NTFS ADS
    PID:4216

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        HiveCloudBridge.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\HiveCloudBridge.dll
        • Size 374KB
        • SHA256 40482452a0cd1082c8f8f76011d284d551c8b0efb5ad58d95a8d79f353750f40
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\Microsoft.Win32.Primitives.dll
        • Size 8KB
        • SHA256 b9904593d7fc3c663cc361a09e1b1f16bbdcd7f6cfe7c1a8cd2912397e319801
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\Microsoft.Win32.Registry.dll
        • Size 24KB
        • SHA256 67d0a92e2b1a78bb864dd7332458f3fbd4a3faa277f0b5527363944f13e53a57
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Collections.Concurrent.dll
        • Size 48KB
        • SHA256 4fd59d540242e98b558b33878e476878a30ed8c65be2724b9947862a9676a254
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Collections.dll
        • Size 27KB
        • SHA256 a6e3addd3badb774f6b7718fcda933a28407ca000bac4e328f947216a2d8c997
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.ComponentModel.Primitives.dll
        • Size 19KB
        • SHA256 d52cb5b5ab09ae4e8941500b25d2afd54af9fe8f1fd5372e4b4418dd78eaa4f7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.ComponentModel.dll
        • Size 5KB
        • SHA256 527e2cc38be94c7d963d359b34acbcd8adbffac371837d13b91bd47633e15e7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.AccessControl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.IO.FileSystem.AccessControl.dll
        • Size 16KB
        • SHA256 bf5e1ae2f8e73db55c6f6beacc5ac33fa414aac8507158b86c338b66313e6aed
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.DriveInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.IO.FileSystem.DriveInfo.dll
        • Size 16KB
        • SHA256 7f5a900c3ee805ae2f6c6cdbc208dd192511ee4da79dda641633075848d5f637
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.FileSystem.Watcher.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.IO.FileSystem.Watcher.dll
        • Size 26KB
        • SHA256 b47e746f4119ebc60cc9f475beaf9c1f4f819ef2602ee8d916b4f10bd97bac68
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.IO.Pipes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.IO.Pipes.dll
        • Size 42KB
        • SHA256 9461bda5613bd85dee848b706fc1305153d94737b0b60cf0fed35a6f25f38ef8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.Expressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Linq.Expressions.dll
        • Size 411KB
        • SHA256 4ec623ece08b1e30bf280ed0ab4aaeb59fd4c9629aa98d4ee56ccf65f56487b7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Linq.dll
        • Size 67KB
        • SHA256 4f9181014fcde12fcd5e361bf864c45f8afb37c1ff27e92d1373fb7b7ffa32c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.Http.dll
        • Size 555KB
        • SHA256 0d8542374e10936e744133833c943333dba486c9ee63e97a078e17370e5a5fb4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Mail.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.Mail.dll
        • Size 145KB
        • SHA256 4bfd5136ad5085bca67316de82e030682b527ebd7af660bf37836c65cefef0df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.NameResolution.dll
        • Size 31KB
        • SHA256 9ba0f8cf232e302ed83606c0fb0efc0adb26b104aefc5fa030154ec17addd2dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.NetworkInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.NetworkInformation.dll
        • Size 33KB
        • SHA256 a939ea768119093020b838b4ec3e09184a364dcc5c7dc985799eb7a7e70b9c64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.Primitives.dll
        • Size 67KB
        • SHA256 b6368df18effbc3a76a31bef27a7534ed079f64fb15c8152e4429254f3ec8b59
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Quic.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.Quic.dll
        • Size 92KB
        • SHA256 85cd457d2c2d887c64162a2e247884e294eb35549d21381331cefdd3548ad452
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Net.Security.dll
        • Size 174KB
        • SHA256 7ddeec8137c777f86ed1d4f85dee5bc94d8dd40d1db2004bb2152e505c989a19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.ObjectModel.dll
        • Size 24KB
        • SHA256 d7c135383f90a814d06cf74c8d6855bc3c5bdbf981d256ae9e8466f5c3075451
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Private.CoreLib.dll
        • Size 2.5MB
        • SHA256 553f49e0790ff8706b1788d8239e147b3eaae63745f72f6c4b58d91ff7c21848
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Private.Uri.dll
        • Size 75KB
        • SHA256 b1f6b4723d36bed58c5e6055aa908ab13b71588666c1c3c44897b79ab82d84be
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Runtime.CompilerServices.Unsafe.dll
        • Size 5KB
        • SHA256 d51f1e7b2078dcc5d52f592df805eb08b84d4b82c91ce309efeb22cae0352340
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.RuntimeInformation.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Runtime.InteropServices.RuntimeInformation.dll
        • Size 10KB
        • SHA256 99f8f76cdb5363bedff7773ce027d0735ebc12b2419811c68a00081e720ad7c7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Runtime.InteropServices.dll
        • Size 8KB
        • SHA256 f7ba93782fce98762fee13106a84c3d579f980b54bd14c7743ba267a7c58fed4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Security.Claims.dll
        • Size 15KB
        • SHA256 c9fe733f30a7e9c2afe2a3dca129704ca3839531cb1559ab3599f1de1d91f41b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Security.Cryptography.Algorithms.dll
        • Size 101KB
        • SHA256 66c26f744fb94c0260a1f3883c7a73908c17de1c4fcddcc285c2c29f4c546f73
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Security.Cryptography.Primitives.dll
        • Size 36KB
        • SHA256 5359dac61a9ac0b8adff2e98ad28ed14daeb1f73fcc943a9e6053fd23112852e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Security.Cryptography.X509Certificates.dll
        • Size 136KB
        • SHA256 68b933eb5c6a5aa26ad1953d05cc3d8ddb62f54132996bcd3f5202ad58a846c6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Security.Principal.Windows.dll
        • Size 50KB
        • SHA256 037ca794c65dca9b27a30fc3bf6add316db1039a8d72302468ea44e5bef1d82a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\7a77a98572b8443b7e5ed44cca3a0fa833d3ee85b2b0d2f097e04441d6ef6af6\n24PsTArogrSGZjb89kc6npYWmhXDvw=\System.Threading.dll
        • Size 19KB
        • SHA256 292ba1bd15b7ff61ee8f1b04689caba19b60b18ce285614c179d5083f06b21d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/4216-148-0x00007FF65B53F000-0x00007FF65B540000-memory.dmp
        Download