Overview

overview

8

Static

static

3

c124b47b5d...8N.exe

windows7-x64

7

c124b47b5d...8N.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 11:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c124b47b5d05c68ed68756bfaa2cb2d16b79def83aeb5ec7e2ee98383ce8c588N.exe

  • Size

    93KB

  • MD5

    5cc3d2a90fe18118db199fd045246390

  • SHA1

    79782f30e93dd1b0dca3737771bf78adb495f38c

  • SHA256

    c124b47b5d05c68ed68756bfaa2cb2d16b79def83aeb5ec7e2ee98383ce8c588

  • SHA512

    2bb352a428723c6cc80cb9307a45c1c7dc1b367c8fa1a43ab04d90735f0376ab8839e6f93d78d330672705b4e49da20fb745371810b87bc2f7a77d7277091c16

  • SSDEEP

    1536:+HxCaqYLXJOfEbvdTvqGORq0H/waHXxoqNFcMeYxoPRR:+Hx8YL02HamwFDoPv

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c124b47b5d05c68ed68756bfaa2cb2d16b79def83aeb5ec7e2ee98383ce8c588N.exe
    "C:\Users\Admin\AppData\Local\Temp\c124b47b5d05c68ed68756bfaa2cb2d16b79def83aeb5ec7e2ee98383ce8c588N.exe"
    1⤵
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3064
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        3⤵
        • Suspicious behavior: MapViewOfSection
        PID:2448
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5060
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:2076
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1880
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1640
  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:708
    • C:\Windows\explorer.exe
      explorer.exe /LOADSAVEDWINDOWS
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1648
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:432
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:908
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3212
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3744
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1568
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    PID:960
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:3104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lsass.exe
    Filesize

    93KB

    MD5

    5cc3d2a90fe18118db199fd045246390

    SHA1

    79782f30e93dd1b0dca3737771bf78adb495f38c

    SHA256

    c124b47b5d05c68ed68756bfaa2cb2d16b79def83aeb5ec7e2ee98383ce8c588

    SHA512

    2bb352a428723c6cc80cb9307a45c1c7dc1b367c8fa1a43ab04d90735f0376ab8839e6f93d78d330672705b4e49da20fb745371810b87bc2f7a77d7277091c16

    Download Submit

  • memory/60-55-0x00007FF9A5C0D000-0x00007FF9A5C0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/60-48-0x0000020D342E0000-0x0000020D34307000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1396-34-0x0000027E712E0000-0x0000027E71307000-memory.dmp

    Filesize

    156KB

    Download

  • memory/1396-54-0x00007FF9A5C0D000-0x00007FF9A5C0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2132-41-0x000001D633F20000-0x000001D633F47000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2448-10-0x0000000000F80000-0x0000000000FA7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2608-37-0x000001D73DD80000-0x000001D73DDA7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2628-40-0x000001A889530000-0x000001A889557000-memory.dmp

    Filesize

    156KB

    Download

  • memory/2696-51-0x0000021B15B80000-0x0000021B15BA7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3064-6-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3064-8-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/3064-7-0x0000000002660000-0x0000000002687000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3248-57-0x000001E1E5900000-0x000001E1E5927000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3468-12-0x0000000002790000-0x00000000027B7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3468-11-0x0000000002790000-0x00000000027B7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3468-70-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3468-24-0x00007FF9A5C0D000-0x00007FF9A5C0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3468-60-0x0000000002800000-0x0000000002801000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3468-28-0x00000000023A0000-0x00000000023B2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3596-43-0x00000236C9C70000-0x00000236C9C97000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3596-52-0x00007FF9A5C0D000-0x00007FF9A5C0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3668-56-0x0000020762800000-0x0000020762827000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3776-67-0x0000023367400000-0x0000023367408000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3776-53-0x00007FF9A5C0D000-0x00007FF9A5C0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3776-44-0x0000023367360000-0x0000023367387000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3776-68-0x00000233673F0000-0x00000233673F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3776-219-0x0000023367310000-0x0000023367311000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3868-45-0x000001F79BF90000-0x000001F79BFB7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/3964-46-0x000001E58D1C0000-0x000001E58D1E7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/4432-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4432-5-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

    Download

  • memory/4476-36-0x000002569DDD0000-0x000002569DDF7000-memory.dmp

    Filesize

    156KB

    Download

  • memory/5060-81-0x00000000081E0000-0x0000000008207000-memory.dmp

    Filesize

    156KB

    Download

  • memory/5060-80-0x0000000008210000-0x0000000008237000-memory.dmp

    Filesize

    156KB

    Download