Overview

overview

6

Static

static

1

2cdafd51da...64.exe

windows7-x64

6

2cdafd51da...64.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    144s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2024, 20:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.exe

  • Size

    1.7MB

  • MD5

    8f02f0f5200616357f8d507ab127425e

  • SHA1

    c1a190a83e1440f3bbdf7bdff828cc4ad7b12535

  • SHA256

    2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164

  • SHA512

    cfd2b68a96f95ffb137b61924d30c05a2d1a984ba2102a9072b3b7e8dbf20aae609339fde913bfc3a96240e018df918d58b2b41f794383360a7cf235dfead69f

  • SSDEEP

    24576:i7FUDowAyrTVE3U5FkFFVZEha7hEq/BPNh3ya0FqGq31WslyjWfaYhECod:iBuZrEUgXZ0a7h3/LhCazGm1ByjMQ

Score
6/10
discovery

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 9 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 12 IoCs
    evasionspywaretrojan
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.exe
    "C:\Users\Admin\AppData\Local\Temp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\is-O3K2D.tmp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-O3K2D.tmp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.tmp" /SL5="$5014E,866469,820736,C:\Users\Admin\AppData\Local\Temp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.exe"
      2⤵
      • Checks for any installed AV software in registry
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    d81477904d94b4a182bd3fde71d9b1c5

    SHA1

    604f5e5a33f70c286e60c81b107e18a6b3c69f76

    SHA256

    51108f05a0384e41b2dda3926267d087d20f5c985e9b93b9ccdf9dda1e1581a7

    SHA512

    8718a1eab611b7747d0564c9811c5cce21422af130a3db901cad6d9bfb20e8fe52ed00b32399f3726101d9e2f809ad69fe306d9c65054f629519e7fd9f1a62b1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab5C93.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5CB6.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-08L44.tmp\106.png
    Filesize

    29KB

    MD5

    0b4fa89d69051df475b75ca654752ef6

    SHA1

    81bf857a2af9e3c3e4632cbb88cd71e40a831a73

    SHA256

    60a9085cea2e072d4b65748cc71f616d3137c1f0b7eed4f77e1b6c9e3aa78b7e

    SHA512

    8106a4974f3453a1e894fec8939038a9692fd87096f716e5aa5895aa14ee1c187a9a9760c0d4aec7c1e0cc7614b4a2dbf9b6c297cc0f7a38ba47837bede3b296

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-08L44.tmp\107.png
    Filesize

    70KB

    MD5

    b582d76d71da0734a777fc8376fd0150

    SHA1

    687de4b5b0844bd720619b39c65f9078ae72e7cf

    SHA256

    1ce2b90c05299026d66af72b8d1fbf4c2abdbcbbd03959b8f05986a48f9034c6

    SHA512

    0d9e2680bcf159446704c82c514320f76af962281dd5e5738c6e56b93c900a43bf2fc5cd5792977ae7bee5ca904774ecd0ff95dab7470901997af4fb6a666053

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\is-08L44.tmp\108.png
    Filesize

    193KB

    MD5

    7c87614f099c75a0bed6ab01555143dd

    SHA1

    07ab72dc4a1e53e2c62ecccc1221472854d78635

    SHA256

    02335420cb5c2fa33eec48f32706d2353f8b609daaf337458f04a8f98d999a7c

    SHA512

    29b7ce896332ed2a05235645adb963b77920a0a252561684ea9f1f925f69dbcee4685e1b30584c1034a15b7efc18b911902d1ecb41c523cf2552ff23e165bf43

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-O3K2D.tmp\2cdafd51da269a6e4c4c407afa6bf4efa19b82c72a0675e084d84f7c212c3164.tmp
    Filesize

    3.0MB

    MD5

    5aced7c5afb3389a84815fe3b420adca

    SHA1

    3d5334ca383afca60d2c8f5a78bb3219dab9a247

    SHA256

    b2d3125984e4cc7b03ed69026e2ba9d5c1326d8cb5927a0129998f3d92581ff7

    SHA512

    80151b64f7837174949c4a207f22388be499af806b9185eafb27312a4580ba1321671bbd7a86bd5230c174867198ebb81aa3a3aaff0703edc739b784ed1af825

    Download Submit

  • memory/2400-0-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/2400-157-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/2400-2-0x0000000000401000-0x00000000004B7000-memory.dmp

    Filesize

    728KB

    Download

  • memory/2668-163-0x0000000007550000-0x0000000007690000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2668-8-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2668-159-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2668-167-0x0000000007550000-0x0000000007690000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2668-169-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2668-158-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2668-173-0x0000000007550000-0x0000000007690000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/2668-175-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2668-177-0x0000000000400000-0x0000000000711000-memory.dmp

    Filesize

    3.1MB

    Download