Overview

overview

10

Static

static

7

0b42c766b0...32.exe

windows7-x64

10

11f9bb7186...6b.exe

windows7-x64

3

childmoney.exe

windows7-x64

3

1c281ece6f...2a.exe

windows7-x64

3

32bb88fa59...4b.exe

windows7-x64

3

5056cbe553...3d.exe

windows7-x64

3

50e0f20cb3...69.exe

windows7-x64

6

57bbc27030...7b.exe

windows7-x64

3

65a84ff98e...02.exe

windows7-x64

10

6db6ac1ce8...be.exe

windows7-x64

10

72745efc42...46.exe

windows7-x64

10

751fb51baa...fe.exe

windows7-x64

10

95e95a5be0...63.exe

windows7-x64

3

a935725900...07.exe

windows7-x64

3

c190931380...74.dll

windows7-x64

3

dafc6c03ef...19.exe

windows7-x64

1

e3c6c48ba7...87.exe

windows7-x64

10

edbb453cc0...46.exe

windows7-x64

5

f633e6f255...4b.exe

windows7-x64

fda537bc5e...ad.exe

windows7-x64

3

Analysis

  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    03-11-2024 19:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    50e0f20cb3844c6b0ddc4af01daf274b7ebdddd0d322f06f05b7d6fec7c16869.exe

  • Size

    564KB

  • MD5

    31aa278085c235260fb64311532b1893

  • SHA1

    2fdbb2ad8abdc69d7d4d1115287f3513c31446a1

  • SHA256

    50e0f20cb3844c6b0ddc4af01daf274b7ebdddd0d322f06f05b7d6fec7c16869

  • SHA512

    b761774f02c3814d8d965ad4e70a3bda31184abbf3f7293c6885904ca192f9406c27ba4c2f0b9ecc1920534a4a01353a8213f880449aa5aa1dc54bfe80357f2d

  • SSDEEP

    12288:bwla+aTeq8Rg1yVkzES8RZTOy0fl+rsuNkabtW:kM+Z3S1uJSCvCwrsqr

Score
6/10
discoverypersistenceupx

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 7 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50e0f20cb3844c6b0ddc4af01daf274b7ebdddd0d322f06f05b7d6fec7c16869.exe
    "C:\Users\Admin\AppData\Local\Temp\50e0f20cb3844c6b0ddc4af01daf274b7ebdddd0d322f06f05b7d6fec7c16869.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2332
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2352
    • C:\Windows\SysWOW64\taskmgr.exe
      "C:\Windows\System32\taskmgr.exe"
      2⤵
        PID:2856
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2900
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2744
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2764
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2772
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2696
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2752
      • C:\Windows\SysWOW64\taskmgr.exe
        "C:\Windows\System32\taskmgr.exe"
        2⤵
          PID:2644
        • C:\Windows\SysWOW64\taskmgr.exe
          "C:\Windows\System32\taskmgr.exe"
          2⤵
            PID:2652
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2660
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2692
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2716
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2760
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2288
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2584
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2176
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: GetForegroundWindowSpam
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:996
          • C:\Windows\SysWOW64\taskmgr.exe
            "C:\Windows\System32\taskmgr.exe"
            2⤵
              PID:924
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2424
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:1632
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2496
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2492
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:2472
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
              • System Location Discovery: System Language Discovery
              PID:956
            • C:\Windows\SysWOW64\taskmgr.exe
              "C:\Windows\System32\taskmgr.exe"
              2⤵
                PID:2504
              • C:\Windows\SysWOW64\taskmgr.exe
                "C:\Windows\System32\taskmgr.exe"
                2⤵
                  PID:1056
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1676
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2084
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1544
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1332
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1732
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1112
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1064
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:1664
                • C:\Windows\SysWOW64\taskmgr.exe
                  "C:\Windows\System32\taskmgr.exe"
                  2⤵
                    PID:1268
                  • C:\Windows\SysWOW64\taskmgr.exe
                    "C:\Windows\System32\taskmgr.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies Internet Explorer settings
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SendNotifyMessage
                    PID:2940
                  • C:\Windows\SysWOW64\taskmgr.exe
                    "C:\Windows\System32\taskmgr.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1172
                  • C:\Windows\SysWOW64\taskmgr.exe
                    "C:\Windows\System32\taskmgr.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2008
                  • C:\Windows\SysWOW64\taskmgr.exe
                    "C:\Windows\System32\taskmgr.exe"
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:1944
                  • C:\Windows\SysWOW64\taskmgr.exe
                    "C:\Windows\System32\taskmgr.exe"
                    2⤵
                      PID:2004
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:2016
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1444
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1152
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1784
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:3048
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1308
                    • C:\Windows\SysWOW64\taskmgr.exe
                      "C:\Windows\System32\taskmgr.exe"
                      2⤵
                        PID:2620
                      • C:\Windows\SysWOW64\taskmgr.exe
                        "C:\Windows\System32\taskmgr.exe"
                        2⤵
                          PID:2624
                        • C:\Windows\SysWOW64\taskmgr.exe
                          "C:\Windows\System32\taskmgr.exe"
                          2⤵
                            PID:940
                          • C:\Windows\SysWOW64\taskmgr.exe
                            "C:\Windows\System32\taskmgr.exe"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            PID:1984
                          • C:\Windows\SysWOW64\taskmgr.exe
                            "C:\Windows\System32\taskmgr.exe"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2124
                          • C:\Windows\SysWOW64\taskmgr.exe
                            "C:\Windows\System32\taskmgr.exe"
                            2⤵
                              PID:1496
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1668
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2448
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2992
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1648
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2064
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2028
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:1060
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                              • System Location Discovery: System Language Discovery
                              PID:2596
                            • C:\Windows\SysWOW64\taskmgr.exe
                              "C:\Windows\System32\taskmgr.exe"
                              2⤵
                                PID:352
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1936
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:376
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies Internet Explorer settings
                                • Modifies registry class
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2324
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2484
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2600
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1708
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1980
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:2416
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:780
                              • C:\Windows\SysWOW64\taskmgr.exe
                                "C:\Windows\System32\taskmgr.exe"
                                2⤵
                                  PID:1832
                                • C:\Windows\SysWOW64\taskmgr.exe
                                  "C:\Windows\System32\taskmgr.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1840
                                • C:\Windows\SysWOW64\taskmgr.exe
                                  "C:\Windows\System32\taskmgr.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2068
                                • C:\Windows\SysWOW64\taskmgr.exe
                                  "C:\Windows\System32\taskmgr.exe"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:936
                                • C:\Windows\SysWOW64\taskmgr.exe
                                  "C:\Windows\System32\taskmgr.exe"
                                  2⤵
                                    PID:932
                                  • C:\Windows\SysWOW64\taskmgr.exe
                                    "C:\Windows\System32\taskmgr.exe"
                                    2⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1912
                                  • C:\Windows\SysWOW64\taskmgr.exe
                                    "C:\Windows\System32\taskmgr.exe"
                                    2⤵
                                      PID:1600

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • memory/996-14-0x00000000038E0000-0x000000000396E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/1664-17-0x0000000003930000-0x00000000039BE000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/1664-20-0x0000000003930000-0x00000000039BE000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2124-19-0x0000000003900000-0x000000000398E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2324-22-0x0000000003720000-0x00000000037AE000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2324-23-0x0000000003720000-0x00000000037AE000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2380-0-0x0000000000400000-0x000000000048E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2380-1-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2380-15-0x0000000000400000-0x000000000048E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2380-16-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                    Filesize

                                    4KB

                                    Download

                                  • memory/2940-18-0x0000000003A00000-0x0000000003A8E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download

                                  • memory/2940-21-0x0000000003A00000-0x0000000003A8E000-memory.dmp

                                    Filesize

                                    568KB

                                    Download