Analysis

  • max time kernel
    125s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:38

General

  • Target

    Release.zip

  • Size

    1.1MB

  • MD5

    047e1e654f02abeb24f95df4e34231bc

  • SHA1

    54df77449d6a833b8459a319ac04e93fd84beab1

  • SHA256

    89af23ff21360079b2ee8011aa959c1b4baf7ab09522e74980a6d86c2aa868dd

  • SHA512

    7d21689e3df3216c22cf248489ad9faa99a2cf10f9521944be50fae61ace29a5a908480fda3c5511b98ca7c55d93c26e16956036fa5fc28561356d3b777dfdcc

  • SSDEEP

    24576:FxVYnMv+gfZLNnOLgr7RSQDexlQxWGo/snKoAj4Ac7nGzglqS/7zafBISC8QE:WnWhZLNOkJSQyPYWHkXE4jbGc1/vaf7F

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Release.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2964
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:988
    • C:\Users\Admin\Downloads\emu\KeyAuthEmulator.exe
      "C:\Users\Admin\Downloads\emu\KeyAuthEmulator.exe"
      1⤵
      • Executes dropped EXE
      PID:1188
    • C:\Users\Admin\Downloads\loader3.exe
      "C:\Users\Admin\Downloads\loader3.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Program Files directory
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\loader3.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\system32\certutil.exe
          certutil -hashfile "C:\Users\Admin\Downloads\loader3.exe" MD5
          3⤵
            PID:1220
          • C:\Windows\system32\find.exe
            find /i /v "md5"
            3⤵
              PID:1980
            • C:\Windows\system32\find.exe
              find /i /v "certutil"
              3⤵
                PID:2368
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c CLS
              2⤵
                PID:460
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c CLS
                2⤵
                  PID:3484
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c CLS
                  2⤵
                    PID:4660
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c CLS
                    2⤵
                      PID:1428
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c CLS
                      2⤵
                        PID:2240
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c CLS
                        2⤵
                          PID:1968
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c CLS
                          2⤵
                            PID:4528
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c cd C:\Program Files\Windows NT\Accessories\en-US\ && 8c9zrj.exe bjtw76.sys >nul 2>&1
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3016
                            • C:\Program Files\Windows NT\Accessories\en-US\8c9zrj.exe
                              8c9zrj.exe bjtw76.sys
                              3⤵
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:3600
                        • C:\Users\Admin\Downloads\loader3.exe
                          "C:\Users\Admin\Downloads\loader3.exe"
                          1⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:2236
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Downloads\loader3.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4964
                            • C:\Windows\system32\certutil.exe
                              certutil -hashfile "C:\Users\Admin\Downloads\loader3.exe" MD5
                              3⤵
                                PID:1152
                              • C:\Windows\system32\find.exe
                                find /i /v "md5"
                                3⤵
                                  PID:3052
                                • C:\Windows\system32\find.exe
                                  find /i /v "certutil"
                                  3⤵
                                    PID:1684
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c CLS
                                  2⤵
                                    PID:4344
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c CLS
                                    2⤵
                                      PID:4904
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c CLS
                                      2⤵
                                        PID:3064
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c CLS
                                        2⤵
                                          PID:1396
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c CLS
                                          2⤵
                                            PID:2944
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c CLS
                                            2⤵
                                              PID:752
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c CLS
                                              2⤵
                                                PID:4532
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c cd C:\Program Files\Windows NT\Accessories\en-US\ && 8c9zrj.exe bjtw76.sys >nul 2>&1
                                                2⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:4504
                                                • C:\Program Files\Windows NT\Accessories\en-US\8c9zrj.exe
                                                  8c9zrj.exe bjtw76.sys
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4152

                                            Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files\Windows NT\Accessories\en-US\symbols\8a7acf8a27881ad9887fc425cd6c5f95.pdb

                                              Filesize

                                              223KB

                                              MD5

                                              dfe8ddd56a1617a07d5c3a99131c4e75

                                              SHA1

                                              bb307024cf33d32ac4a679bd966cb2f12f2a89cd

                                              SHA256

                                              c135f7fff8d8210aa1f71f2fc560aa35e1a64372bf26610b693814c31fc53406

                                              SHA512

                                              84635e4929ef075ca09d3507faae159a3d64f115075d44c8a3ebedbe2506948bb59f6b95280db08fde5903cde31a43c94d94ca79e4cfe895e5ddcb164150abaa

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                              Filesize

                                              471B

                                              MD5

                                              be9e8d8924121c12f831ce40c1b386ac

                                              SHA1

                                              406c46f2b991b85091e349b2484ced5834f6cc9a

                                              SHA256

                                              d861c6ae663fd62a02264ace01246b293be07eaac463b139a2cbb77866138daa

                                              SHA512

                                              6eb20990d8cbc361f5f33114b82d18ebd52ad9abfdc1ef4d12cacac62e91f728f1d0bf1df476868abe0be2cdd454f7423ffbca4e39603dcc01e0400e562ecd67

                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

                                              Filesize

                                              412B

                                              MD5

                                              fa6a3a89d780f2d3769d485503c01033

                                              SHA1

                                              ea211b52df010c370d3fde421a516b4c7f512ac4

                                              SHA256

                                              153b72413f78666d280dfb656f7bdd3d8b846cf2de9de3b1947598084f4dd3d1

                                              SHA512

                                              60862b3dc4788a652f113fc3b8790bb4f468058daee8eac09f5c02ae2bb6455d170af13217f5e4e3c95c071504286a4638a388240d61a38d6152529baff83730

                                            • C:\Users\Admin\Downloads\emu\675606

                                              Filesize

                                              26KB

                                              MD5

                                              1601dd52ad1b2650ad43b8a9b204d360

                                              SHA1

                                              728f636af02e422bf87001e6b685d4293b725871

                                              SHA256

                                              a816e84471064911c79f247bbc79cb126e97065aaf766015669cf3fcde9dd7c4

                                              SHA512

                                              19caf163f7a0e11f3e8f85ed8b3b488a9e078add7fd01dd44d13fb35cf3a6a1ff3288a5ab8d9a64af95f65091904125cbeaf6ea6d19f3d003ecf489e0c4af37e

                                            • C:\Users\Admin\Downloads\emu\878321

                                              Filesize

                                              142KB

                                              MD5

                                              e2702cd687534dcf328d004f13bda94a

                                              SHA1

                                              f519ca25e18dca6c15d3d15849d8764cb6a13943

                                              SHA256

                                              bb4b323f6d51ff84b0d9a502cb25fea638c497c07caffcb1391c4060a27c6bc1

                                              SHA512

                                              d4726ae28db86d5adbd6c73783dd7919a3744e9e6280be4c0480ce74c5872c19dc6471c16ee05c0c441ac008e1a7fd32c01a633873bcd370c66d719924d70af0

                                            • C:\Users\Admin\Downloads\emu\KeyAuthEmulator.deps.json

                                              Filesize

                                              437B

                                              MD5

                                              47306d1fc832c57ab35f197f48e05864

                                              SHA1

                                              3606f87598d00701916d8ea63fb1b118cf47a418

                                              SHA256

                                              98150b82cbb9f35dc99daa5116d9eae18adf22c11cbe245e1822ff42a254d624

                                              SHA512

                                              cd0465b45c49d95bcf1c395d2d90fad37fcc53a7969afa3059d49abbc30d90732471398b4efc6b52fcb4b0f0878a01b3a5bf6d19fead1f18331b2fb63b118a2b

                                            • C:\Users\Admin\Downloads\emu\KeyAuthEmulator.dll

                                              Filesize

                                              25KB

                                              MD5

                                              4451edb88fdb64579dbc30f0d7d1c855

                                              SHA1

                                              9869832cb3d088edde91ffdb62aed911e8f6fe6f

                                              SHA256

                                              5a476075a4fc6125c28cdb14e3a71af4f5a62f8e54ded8b610898ef81fc9721b

                                              SHA512

                                              155e6ab88d527bd28902b14f335af9ec667574f56898f8d3757ada9354d3817317df201484ecf2c5c1c4569c5995bf620adc9ce65e889556cbb4410eb344ee7d

                                            • C:\Users\Admin\Downloads\emu\KeyAuthEmulator.exe

                                              Filesize

                                              135KB

                                              MD5

                                              cf78d5995312872c075ae9772a14a5a2

                                              SHA1

                                              1de6c53b6acad6140567693f0fff7379826477a5

                                              SHA256

                                              71fede3d07f8b24d08e15748abcd95abcfe48e21a5a71f0c96d6bf752c12252c

                                              SHA512

                                              d4ca332800195a3a1c0dbe7c1669d91e23f5ad68c491589c8168b0040114fb761672778c39f092e8909133a1027e25e836f3951e17cffbc20e5fe5e271b0d845

                                            • C:\Users\Admin\Downloads\emu\KeyAuthEmulator.runtimeconfig.json

                                              Filesize

                                              268B

                                              MD5

                                              9fcdf880f73e74cf6347f8194b9f3509

                                              SHA1

                                              ab571c7ed4920129c89c7e083f3c9f22597198bc

                                              SHA256

                                              162d81f468bec570ec15e527433f4de5d5729ffe338ab79b22671f38760d34bd

                                              SHA512

                                              23ea2a78914aeec443bded1e6dddb1fce61f0445c53e0428e97353dcc25e9ee80a98603069de336d57c1d12b00eb14ad59847137387df330a3925bd763f4fde1

                                            • C:\Users\Admin\Downloads\emu\secret.txt

                                              Filesize

                                              64B

                                              MD5

                                              e8365894de54b276c0d2f3b1f3d4eed7

                                              SHA1

                                              ab75f9e802ba138fdcc5ea5b76de26d12415b1b4

                                              SHA256

                                              f7db4f7979ab418b7c01c16de9bc2041a674afb89daa051712360244decd5763

                                              SHA512

                                              cd54e2857a2873a4f56456bad22f260915a3e7dcfc5e90009a0c489f6e1762ba25a9cbb2f5cc900504c3b11c80602cacebf542ecc6e8b9b6dc6fb0377ff6c597

                                            • C:\Users\Admin\Downloads\loader3.exe

                                              Filesize

                                              2.0MB

                                              MD5

                                              c1afc5729255d68bf6f7ac02e43935dc

                                              SHA1

                                              ca62f75238efa0daf3521e2df1a44fc6a7784315

                                              SHA256

                                              6cdb812daba9157f3c51ebdda2b38268f32c7ca4048e7c4364c5b354a32a0ba0

                                              SHA512

                                              476a301a51893a79c1916ab9f45c0d45c89e8b3e81bf8108c6ac305fc602be2c720ad6cc88393b300824895d30add2454afbe4d7e1a282510e0430f4973f9fe0