Overview
overview
10Static
static
3INQUIRY 20...20.exe
windows7-x64
10INQUIRY 20...20.exe
windows10-2004-x64
7$APPDATA/s...DH.dll
windows7-x64
1$APPDATA/s...DH.dll
windows10-2004-x64
1$APPDATA/s...ui.dll
windows7-x64
1$APPDATA/s...ui.dll
windows10-2004-x64
1$APPDATA/s...sX.exe
windows7-x64
1$APPDATA/s...sX.exe
windows10-2004-x64
1$APPDATA/s...60.dll
windows7-x64
1$APPDATA/s...60.dll
windows10-2004-x64
1$APPDATA/s...cl.dll
windows7-x64
3$APPDATA/s...cl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$TEMP/Barracoon.dll
windows7-x64
3$TEMP/Barracoon.dll
windows10-2004-x64
3$TEMP/alum...60.dll
windows7-x64
1$TEMP/alum...60.dll
windows10-2004-x64
1$TEMP/alum...xy.exe
windows7-x64
3$TEMP/alum...xy.exe
windows10-2004-x64
3$TEMP/alum...gP.dll
windows7-x64
3$TEMP/alum...gP.dll
windows10-2004-x64
3$TEMP/alum...ap.dll
windows7-x64
1$TEMP/alum...ap.dll
windows10-2004-x64
1$TEMP/map/...60.dll
windows7-x64
1$TEMP/map/...60.dll
windows10-2004-x64
1$TEMP/map/...ip.dll
windows7-x64
8$TEMP/map/...ip.dll
windows10-2004-x64
8$TEMP/refe...80.dll
windows7-x64
1$TEMP/refe...80.dll
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 04:29
Static task
static1
Behavioral task
behavioral1
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
INQUIRY 200609-07_06_2020.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$APPDATA/simpleLogin/ear/jbimpui.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$APPDATA/simpleLogin/ear/resToResX.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$APPDATA/speakers/manifest/74.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$APPDATA/speakers/manifest/edbgcl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/advsplash.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/advsplash.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$TEMP/Barracoon.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$TEMP/Barracoon.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$TEMP/alumni_reunions/calendars/retail/52.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$TEMP/alumni_reunions/calendars/retail/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
$TEMP/alumni_reunions/calendars/retail/VsLogP.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$TEMP/alumni_reunions/calendars/retail/almap.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$TEMP/map/clickheat/documents/74.opends60.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
$TEMP/map/clickheat/documents/msisip.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$TEMP/referral/msvcrt80.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
$TEMP/referral/msvcrt80.dll
Resource
win10v2004-20240802-en
General
-
Target
$APPDATA/simpleLogin/ear/AvVsPkDH.dll
-
Size
26KB
-
MD5
dcb503b44bfe005df85e08a645e7c1e3
-
SHA1
30e1cf630147d901c792049b1902885b4ffe0af8
-
SHA256
28b451525a9122e07d3925643c432fb5b6625919d2ce172a65f79eae64c3aa9f
-
SHA512
9bba86c81d55e6bf200a73c1233d806b57f6049aa30d17d5ad0cf6ce32a6e28581148b61c6f6f88c212346fa2d6cbcacabfd88e724ff6ceb40637f719f2e6c5e
-
SSDEEP
384:UCjkl0Ke5XN3XEUwBxGTKyP5IULV7pTuWECTE9W8S9UkOWKrhmdTXcpddWBK2yW4:UCjGe5dE2KkrxVTPTeFS9UkOWqmdTp
Malware Config
Signatures
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\$APPDATA\simpleLogin\ear\AvVsPkDH.dll1⤵PID:3884
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:81⤵PID:4648