Analysis Overview
SHA256
b68cf8f600b5ad9107988a8f73fec054852416853dcf4b1b66c9bd63324baefe
Threat Level: Shows suspicious behavior
The file nurikalfa.exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Detects Pyinstaller
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Unsigned PE
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Modifies data under HKEY_USERS
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-13 17:10
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-13 17:10
Reported
2024-11-13 17:11
Platform
win10v2004-20241007-en
Max time kernel
8s
Max time network
11s
Command Line
Signatures
Loads dropped DLL
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartupShutdownScript = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nurikalfa.exe" | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Modifies data under HKEY_USERS
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "206" | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (data) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 | C:\Windows\system32\LogonUI.exe | N/A |
| Key created | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" | C:\Windows\system32\LogonUI.exe | N/A |
| Set value (int) | \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" | C:\Windows\system32\LogonUI.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2878641211-696417878-3864914810-1000\{FEE186C6-7051-4F67-A2AB-A4F9D41683E1} | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | C:\Windows\system32\shutdown.exe | N/A |
| Token: SeRemoteShutdownPrivilege | N/A | C:\Windows\system32\shutdown.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\LogonUI.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4820 wrote to memory of 812 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe |
| PID 4820 wrote to memory of 812 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe |
| PID 812 wrote to memory of 2972 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Windows\system32\cmd.exe |
| PID 812 wrote to memory of 2972 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Windows\system32\cmd.exe |
| PID 2972 wrote to memory of 3500 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\shutdown.exe |
| PID 2972 wrote to memory of 3500 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\shutdown.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe
"C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe"
C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe
"C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c shutdown /s /t 1
C:\Windows\system32\shutdown.exe
shutdown /s /t 1
C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3913055 /state1:0x41c64e6d
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 100.208.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 162.159.135.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 232.135.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 94.65.42.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI48202\ucrtbase.dll
| MD5 | 34168a4af676d6a5733bbf7a0905d3c7 |
| SHA1 | ba63e51ab3cd90666eb9a9bb0232502a5ec629ff |
| SHA256 | 2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7 |
| SHA512 | c049c166b2b00dc30b0edae5d78badfffea7fb105f0cff9f3ae2c947ddf3ecde6331855b7ebed3f4ce923cc365b053b3a679319b2c6efa85ed0b9a7ddb5676ab |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\python311.dll
| MD5 | d06da79bfd21bb355dc3e20e17d3776c |
| SHA1 | 610712e77f80d2507ffe85129bfeb1ff72fa38bf |
| SHA256 | 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1 |
| SHA512 | e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140.dll
| MD5 | be8dbe2dc77ebe7f88f910c61aec691a |
| SHA1 | a19f08bb2b1c1de5bb61daf9f2304531321e0e40 |
| SHA256 | 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83 |
| SHA512 | 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\base_library.zip
| MD5 | 0bae56fc5eb06138c83fbcfa3ff6e1e2 |
| SHA1 | e25cec69821600e987b1b1fc5ee9dd31f752158f |
| SHA256 | 150479233e4480040fd9866c584dddf50917ab3448384f5aa94e3736c2d28189 |
| SHA512 | 550482eb0efd0f340833db2f57f328f79064b98398886baa7e6479f6cb493c5a29600c7a3369aa116abdba4ecd42c3d6f6248c1bd6078ab24d026e4f383dec87 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_ctypes.pyd
| MD5 | a25cdcf630c024047a47a53728dc87cd |
| SHA1 | 8555ae488e0226a272fd7db9f9bdbb7853e61a21 |
| SHA256 | 3d43869a4507ed8ece285ae85782d83bb16328cf636170acb895c227ebb142ac |
| SHA512 | f6a4272deddc5c5c033a06e80941a16f688e28179eab3dbc4f7a9085ea4ad6998b89fc9ac501c5bf6fea87e0ba1d9f2eda819ad183b6fa7b6ddf1e91366c12af |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\python3.DLL
| MD5 | 35da4143951c5354262a28dee569b7b2 |
| SHA1 | b07cb6b28c08c012eecb9fd7d74040163cdf4e0e |
| SHA256 | 920350a7c24c46339754e38d0db34ab558e891da0b3a389d5230a0d379bee802 |
| SHA512 | 2976667732f9ee797b7049d86fd9beeb05409adb7b89e3f5b1c875c72a4076cf65c762632b7230d7f581c052fce65bb91c1614c9e3a52a738051c3bc3d167a23 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libffi-8.dll
| MD5 | 0f8e4992ca92baaf54cc0b43aaccce21 |
| SHA1 | c7300975df267b1d6adcbac0ac93fd7b1ab49bd2 |
| SHA256 | eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a |
| SHA512 | 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-debug-l1-1-0.dll
| MD5 | f91f7dc238de2c03dc64aa5d2e3b4e49 |
| SHA1 | 53b1fe15e7a9800456f063e8dbd11f240f6095a3 |
| SHA256 | d3b5273eccc758493c9cfac5cc43ea74f08216bb1c195609ab27e9b2a241d8b3 |
| SHA512 | d8db7213a4bb58bb497d4ee2d06a021a607436ca691462d0dc0c06c17ae345349d03406729a399d2931715cb6dc5a653247851dce701a02e254d8a258bea7fcb |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-datetime-l1-1-0.dll
| MD5 | b3f46f0820b641c5a9a9d0a4bfc94355 |
| SHA1 | 1aa8579aa13d4075c4082245317cb1dcc4ba6b4e |
| SHA256 | e353ecf9deb083da0f00f40f2fe99cc4eea4a904e7118a1cac4ef6e43f89b154 |
| SHA512 | 67a678e125e9e0ce0b9c5fed35cad0513c3b5ff6f86760b32991cfeff5234ec65840c808be2911d57876d8c49076302033e8dcb5032a05f4c0e11964d81b33e8 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-console-l1-1-0.dll
| MD5 | e4a519ef5d0a378ea82c423fe1e4586e |
| SHA1 | ae69723c2540eb1c13ef047c3df25e103e6ec1d9 |
| SHA256 | 5c1cbd16acf9191f17525f5dd887d944b4eb0083c5ec1adb68ce1b82639182ae |
| SHA512 | 6be292efb363b5e00b4f303621a90d6ea20cf3512e3538508c58bc12f6ac024080eb9f0bc2ea112935ad0a955b05d19d784d22de815ba0c2b4feaf6412d11a07 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_cffi_backend.cp311-win_amd64.pyd
| MD5 | 210def84bb2c35115a2b2ac25e3ffd8f |
| SHA1 | 0376b275c81c25d4df2be4789c875b31f106bd09 |
| SHA256 | 59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf |
| SHA512 | cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_bz2.pyd
| MD5 | 37eace4b806b32f829de08db3803b707 |
| SHA1 | 8a4e2bb2d04685856d1de95b00f3ffc6ea1e76b9 |
| SHA256 | 1be51ef2b5acbe490217aa1ff12618d24b95df6136c6844714b9ca997b4c7f9b |
| SHA512 | 1591a263de16373ee84594943a0993721b1e1a2f56140d348a646347a8e9760930df4f632adcee9c9870f9c20d7818a3a8c61b956723bf94777e0b7fb7689b2d |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_asyncio.pyd
| MD5 | 41806866d74e5edce05edc0ad47752b9 |
| SHA1 | c3d603c029fdac45bac37bb2f449fab86b8845dd |
| SHA256 | 76db93bd64cb4a36edb37694456f89bb588db98cf2733eb436f000b309eec3b2 |
| SHA512 | 2a019efaf3315b8b98be93ac4bea15cec8b9ecc6eab298fa93d3947bad2422b5a126d52cb4998363bdc82641fba9b8f42d589afe52d02914e55a5a6116989fde |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\VCRUNTIME140_1.dll
| MD5 | f8dfa78045620cf8a732e67d1b1eb53d |
| SHA1 | ff9a604d8c99405bfdbbf4295825d3fcbc792704 |
| SHA256 | a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5 |
| SHA512 | ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\unicodedata.pyd
| MD5 | 5cc36a5de45a2c16035ade016b4348eb |
| SHA1 | 35b159110e284b83b7065d2cff0b5ef4ccfa7bf1 |
| SHA256 | f28ac3e3ad02f9e1d8b22df15fa30b2190b080261a9adc6855248548cd870d20 |
| SHA512 | 9cccbf81e80c32976b7b2e0e3978e8f7350cce542356131b24ebab34b256efd44643d41ee4b2994b9152c2e5af302aa182a1889c99605140f47494a501ef46c1 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\select.pyd
| MD5 | e07ae2f7f28305b81adfd256716ae8c6 |
| SHA1 | 9222cd34c14a116e7b9b70a82f72fc523ef2b2f6 |
| SHA256 | fb06ac13f8b444c3f7ae5d2af15710a4e60a126c3c61a1f1e1683f05f685626c |
| SHA512 | acb143194ca465936a48366265ae3e11a2256aeae333c576c8c74f8ed9b60987daff81647aef74e236b30687a28bc7e3aa21c6aedbfa47b1501658a2bfd117b4 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\pyexpat.pyd
| MD5 | d7ecc2746314fec5ca46b64c964ea93e |
| SHA1 | 39fc49d4058a65f0aa4fbdc3d3bcc8c7beecaa01 |
| SHA256 | 58b95f03a2d7ec49f5260e3e874d2b9fb76e95ecc80537e27abef0c74d03cb00 |
| SHA512 | d5a595aaf3c7603804deae4d4cc34130876a4c38ccd9f9f29d8b8b11906fa1a03dd9a1f8f5dbde9dc2c62b89fe52dfe5b4ee409a8d336edf7b5b8141d12e82d2 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libssl-3.dll
| MD5 | 19a2aba25456181d5fb572d88ac0e73e |
| SHA1 | 656ca8cdfc9c3a6379536e2027e93408851483db |
| SHA256 | 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006 |
| SHA512 | df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\libcrypto-3.dll
| MD5 | e547cf6d296a88f5b1c352c116df7c0c |
| SHA1 | cafa14e0367f7c13ad140fd556f10f320a039783 |
| SHA256 | 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de |
| SHA512 | 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-utility-l1-1-0.dll
| MD5 | f440dc5623419e013d07dd1fcd197156 |
| SHA1 | 0e717f3ab9ccf1826a61eeccda9551d122730713 |
| SHA256 | bba068f29609630e8c6547f1e9219e11077426c4f1e4a93b712bfba11a149358 |
| SHA512 | e3fc916011d0caa0f8e194464d719e25eec62f48282c2bf815e4257d68eddb35e2e88cb44983fe2f202ee56af12bb026da90a5261a99272dabf2a13794a69898 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-time-l1-1-0.dll
| MD5 | 05af3f787a38ed1974ff3bda3d752e69 |
| SHA1 | c88117f16a0ae4ccb4f3d3c8e733d213de654b04 |
| SHA256 | f4163cbc464a82fce47442447351265a287561c8d64ecc2f2f97f5e73bcb4347 |
| SHA512 | 9bc364a4361e6ce3e9fc85317e8a252516006d1bae4bf8d2e0273337bbb7fe4a068a3e29966ff2707e974af323dd9ab7b086582504d3caed2ceb1e14d4a37559 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-string-l1-1-0.dll
| MD5 | 3a96f417129d6e26232dc64e8fee89a0 |
| SHA1 | 47f9d89ea1694b94f4f8c5558311a915eca45379 |
| SHA256 | 01e3c0aa24ce9f8d62753702df5d7a827c390af5e2b76d1f1a5b96c777fd1a4e |
| SHA512 | 0898c2c8751a6a0f75417c54157228ccf0e9f3facbfecc1268ecbd3d50eca69a3909c39ca788d9e2d5ccbf3b5ebcdc960df49e40a9c945fc8007d2dc4474f718 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-stdio-l1-1-0.dll
| MD5 | 53e23e326c11191a57ddf7ada5aa3c17 |
| SHA1 | af60bcca74f5b4b65c2b322ac7a5cedb9609c238 |
| SHA256 | 293c76a26fbc0c86dcf5906dd9d9ddc77a5609ea8c191e88bdc907c03b80a3a5 |
| SHA512 | 82c71b003332006beeafb99306dbcc6517a0f31f9659ea6b1607a88d6a2b15420aef6c47dfaf21fd3bd7502135fb37ba7a9321fc2a9b82c7deb85a75d43a6f58 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-runtime-l1-1-0.dll
| MD5 | c25321fe3a7244736383842a7c2c199f |
| SHA1 | 427ea01fc015a67ffd057a0e07166b7cd595dcfd |
| SHA256 | bf55134f17b93d8ac4d8159a952bee17cb0c925f5256aa7f747c13e5f2d00661 |
| SHA512 | 3aa08138a4bba4d5619e894e3ec66cc540db9f5fe94e226c9b4fc8a068ddb13039335aa72731e5dbdb89dfc6550c9f5d8f03441001c8fd43a77795a2197a8c60 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-process-l1-1-0.dll
| MD5 | e18fd20e089cb2c2c58556575828be36 |
| SHA1 | 1ccdc9443bae71a5455eff93a304eae16f087be7 |
| SHA256 | b06b2d8c944bff73bd5a4aad1cad6a4d724633e7bd6c6b9e236e35a99b1d35f2 |
| SHA512 | 630d4992120ff0646f16d95a5a2cea6c727f87e01124ebd7f1158cef69adcd7d04b5676bd47fac4462c05cf070c520b6dc0016c30705b50894d406992c81f44f |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-private-l1-1-0.dll
| MD5 | b4be272187cb85e719dfb5bf48bb9b1b |
| SHA1 | 1c1b672759c2922082da07af77f0769d27e2e9aa |
| SHA256 | ccaf41e616b9a872d35c8083cbf8fdc14371fa3ef159fe699514643c26a4ebf3 |
| SHA512 | d73ec9acad4fc73c27749ae136914a9dfcac0e965dec7db0f4784aac8d4b9d0e8cde3d28be8a53f53faab06ca0aa9e1a2962a03bd88fc8b044c46db36a00c446 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-math-l1-1-0.dll
| MD5 | 877c5ff146078466ff4370f3c0f02100 |
| SHA1 | 85cf4c4a59f3b0442cdc346956b377bae5b9ca76 |
| SHA256 | 9b05a43fdc185497e8c2cea3c6b9eb0d74327bd70913a298a6e8af64514190e8 |
| SHA512 | 4bc5116d160c31aa24264f02e5d8ba0bd33e26e9632f9ad9018f5bb1964a5c99b325b19db9895483efb82f173962c8dfe70a857db3dfd11796cba82c0d9acd8d |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-locale-l1-1-0.dll
| MD5 | 0d50a16c2b3ec10b4d4e80ffeb0c1074 |
| SHA1 | b81f1639d62dfc7be7ae4d51dd3fae7f29a1a297 |
| SHA256 | fab41a942f623590402e4150a29d0f6f918ee096dba1e8b320ade3ec286c7475 |
| SHA512 | bfee8b2fa8bc5d95e699a82d01a6841a9ac210c288b9dd0aba20b7ebbcfb4363adde439404fe98dc03a6db38873902a335bca77e484fb46f04218696395f1877 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-heap-l1-1-0.dll
| MD5 | 5d409d47f9aebd6015f7c71d526028c3 |
| SHA1 | 0da61111b1e3dbb957162705aa2dbc4e693efb35 |
| SHA256 | 7050043b0362c928aa63dd7800e5b123c775425eba21a5c57cbc052ebc1b0ba2 |
| SHA512 | 62d2e5a6399f3cbd432e233cea8db0199df5c534870c29d7f5b30f935154cb9b756977d865514e57f52ff8b9be37f25cce5118d83c9039e47d9e8f95aa2575ce |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-filesystem-l1-1-0.dll
| MD5 | d76f73be5b6a2b5e2fa47bc39eccdfe5 |
| SHA1 | dfed2b210e65d61bf08847477a28a09b7765e900 |
| SHA256 | 6c86e40c956eb6a77313fa8dd9c46579c5421fa890043f724c004a66796d37a6 |
| SHA512 | 72a048fd647ba22d25f7680884ec7f9216c6bdbb7011869731b221d844a9a493dd502770d08dabb04f867c47ece29ca89b8762d97d71afe6788d72e3f8a30bb7 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-environment-l1-1-0.dll
| MD5 | fe93c3825a95b48c27775664dc54cae4 |
| SHA1 | bae2925776e15081f445fbdd708e0179869b126d |
| SHA256 | c4ed8f65c5a0dbf325482a69ab9f8cbd8c97d6120b87ce90ac4cba54ac7d377a |
| SHA512 | 23a7bc53b35de4893219a3b864c2355fd08f297b3c096000e1621ca0db974aa4b4799fd037f3a25b023e9ee81f304d351f92409aa6d9623bf27b5a8971b58a23 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-convert-l1-1-0.dll
| MD5 | afc20d2ef1f6042f34006d01bfe82777 |
| SHA1 | a13adfc0d03bb06d4a8fe7fb4516f3e21258c333 |
| SHA256 | cd5256b2fb46deaa440950e4a68466b2b0ff61f28888383094182561738d10a9 |
| SHA512 | 2c9f87d50d60ebe4c56257caf4dcf3db4d36739768274acc1d41d98676c3dd1527a9fdc998bfa00227d599fb9893aa20756bc34623fa9b678da5c10a0d0d2550 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-crt-conio-l1-1-0.dll
| MD5 | e3d0f4e97f07033c1feaf72362bbb367 |
| SHA1 | 2a175cea6f80ebe468d71260afb88da98df43bed |
| SHA256 | 3067981026fad83882f211bfe32210ce17f89c6a15916c13e62069e00d5a19e3 |
| SHA512 | 794ae1574883a5320c97f32e4d8a45c211151223ba8b8f790a5a6f2b2bd8366a6fcb1b5e1d9b4a14d28372f15e05c6ad45801d67059e0aba4f5e0a62aa20966c |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-util-l1-1-0.dll
| MD5 | 7a664d454e9675cb3aac9f7c5a7b32b3 |
| SHA1 | e583b12a9d1463eb05d847e623d5a39d38d055c6 |
| SHA256 | 77b53d3970c7e3f68e0c31b7f3cd64b671a3003c5a771d4659c48339331f2994 |
| SHA512 | 1826bb69b9689960b78edbab7eb3c792a6ef2eedb4a7db2c801af4f6b53305614b4200b21fb2e27e2f0931881ea0ff1cc480bc63d7c31f4a5e043a6ac168b7b0 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | bdd63ea2508c27b43e6d52b10da16915 |
| SHA1 | 2a379a1ac406f70002f200e1af4fed95b62e7cb8 |
| SHA256 | 7d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf |
| SHA512 | b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-sysinfo-l1-1-0.dll
| MD5 | 178eaf8111dfdd995e15fd2e3f4545cb |
| SHA1 | 2e15e1f76a8128584b48b742f03e0bb11eccddee |
| SHA256 | 2fa840523904c7b133ded29ec073a9c24184202e8847c9e731897fdd8473b367 |
| SHA512 | b237d180e1743bd230b13e931e3fe725d6e8f430360311b532eed71eb3e42ca604d99d43f42969bf657cdb46ea9b0fd5027f553e0292c7376a18bf586adf6789 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-synch-l1-2-0.dll
| MD5 | b9bc664a451424342a73a8b12918f88d |
| SHA1 | c65599def1e69aed55ea557847d78bb3717d1d62 |
| SHA256 | 0c5c4dfea72595fb7ae410f8fa8da983b53a83ce81aea144fa20cab613e641b7 |
| SHA512 | fe3f393fd61d35b368e42c3333656298a8243ba91b8242ee356950f8925317bf32ce4f37670b16a5a5ab5091903e61ae9c49c03fdc5f93193f215a58d80b9311 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-synch-l1-1-0.dll
| MD5 | fc2e64b5eea906d30694db192603b21f |
| SHA1 | 98ca55d28ae0e9d5609a5d586c8054285ffedf89 |
| SHA256 | 59e86b54319f7a6872cd888582c75559b96ae6f67c0dfe554184538b0ed08cd7 |
| SHA512 | 8b87825bc0d4166c0278c5eafe83cad2065126deab6cd7eae9d3290711ac5f6fcf858cfb5216791ed0709c14e280e7d02caa1004699879359bcc6f6766abf08d |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-string-l1-1-0.dll
| MD5 | 6ba0b8044f21a5c0086f5b8d2ac15d89 |
| SHA1 | 52d0bb8eea87682adf4ab77b45b5bc71d9545170 |
| SHA256 | ac18630de43781ac58f0a8a1aba4304292e0f73db93acbe606b1814fecea0822 |
| SHA512 | d3e92cab97b5de5ca72e1af0c558c24a922b9776cf54f5400dd6d3412d7524c42973ca4d17c8d1ae998b79e8c9b29e75edeb90d438812106d249b7e8d30aef13 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-rtlsupport-l1-1-0.dll
| MD5 | fdb1476dcb99850f82b9567956a7a46b |
| SHA1 | d2d1004fbecb1e25f26da7a6a3d8f7a87fb1ee7a |
| SHA256 | ea04e9b6cf4646d36ab691ff93964f0c7b0b01fd194b8db37a96fb1513ae656a |
| SHA512 | eef15096b7535f13795102442619d8e6651c49b119261c09fe4404cdbd4dc2e63f3a073e92365d67598076501f26485dc6eeb6c2bbae9ec882319fd5ee4f7629 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_hashlib.pyd
| MD5 | ba682dfcdd600a4bb43a51a0d696a64c |
| SHA1 | df85ad909e9641f8fcaa0f8f5622c88d904e9e20 |
| SHA256 | 2ad55e11bddb5b65cdf6e9e126d82a3b64551f7ad9d4cbf74a1058fd7e5993bd |
| SHA512 | 79c607e58881d3c3dfb83886fe7aa4cddb5221c50499d33fe21e1efb0ffa1fd0d3f52cbe97b16b04fbe2b067d6eb5997ac66dec9d2a160d3cb6d44ffca0f5636 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\_decimal.pyd
| MD5 | e4e032221aca4033f9d730f19dc3b21a |
| SHA1 | 584a3b4bc26a323ce268a64aad90c746731f9a48 |
| SHA256 | 23bdd07b84d2dbcb077624d6dcbfc66ab13a9ef5f9eebe31dc0ffece21b9e50c |
| SHA512 | 4a350ba9e8481b66e7047c9e6c68e6729f8074a29ef803ed8452c04d6d61f8f70300d5788c4c3164b0c8fb63e7c9715236c0952c3166b606e1c7d7fff36b7c4c |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-profile-l1-1-0.dll
| MD5 | f8a266ba5362a17c89df60b5b5ebef41 |
| SHA1 | 7f3f9d5875ef3c2d79667a1231d85d9eb619fbc9 |
| SHA256 | 753494588fa1c14146a9a3f7d0f02ddd0a6850ba6a719e2513a64cf9dbf1ae7d |
| SHA512 | 12bebb1186974a9974aaae5630d0957f339c96add2d8bb4bb35ee4b97873fd8d23d73e427ccdee984f0baa79aa2406b25ed198e2e7ad8212ee087be8229c0be9 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 247061d7c5542286aeddade76897f404 |
| SHA1 | 7285f85440b6eff8731943b73502f58ae40e95a2 |
| SHA256 | ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b |
| SHA512 | 23ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-processthreads-l1-1-0.dll
| MD5 | c12244db4c14058f457bfb3b9a1fd21f |
| SHA1 | 8c96972da78b6424958cf976dc7313497ebeaeb5 |
| SHA256 | bc5ddb364256a38e57b21b1a16b5736a8eacbae32b4c3760514cf51629066881 |
| SHA512 | da1bb9099e5fa0c65ae361ef10bd06199b76132bb40cfc3078824fcdfb8032ff745ca852edf65ec5e0e948d5e1413cc219bbba366906d417095b9e46bdea6011 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-processenvironment-l1-1-0.dll
| MD5 | f4f8bd9a68cecff1d22204d29cf8a914 |
| SHA1 | 1fbd4fc3c3edae151ee2d4ad4861a6667a736f44 |
| SHA256 | 6088c2aa22ae8a579518c347163571e243d9a74d542176d63520f370040382e3 |
| SHA512 | 3d9da1e0d4531cb006ba72d0afaf49bc54a4db9f782125a375444b1e97d012d4caf6bdd26128614362137c6aac616ce6d84bda24c629a4e59b55347f69b12b5c |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-namedpipe-l1-1-0.dll
| MD5 | 627327251bc258aa258848de32b698ba |
| SHA1 | dd5831226ba1ed697cb1b74b3a4136ca17aba19a |
| SHA256 | 5ebd891df029e795372f8665db7f15b4964d434aa8d58eb2b50634bc58d74132 |
| SHA512 | 874a76efd19d1ad5f479b975bfe23ae70b3049f872d7371b461de48f3f3a2f76346d6eab406529b32d05fa0894b716ddd2f27980b8e5332b241dce168afc9261 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-memory-l1-1-0.dll
| MD5 | d14c0b3bc3032a043ddffbc39d26db7c |
| SHA1 | c196d43f13c6bf8f0596e3c9b9f54a555099ed48 |
| SHA256 | d699e0c0de1d2f12bb69b3d464faa7ad4734d18a3e725877d8a96aabf29c0542 |
| SHA512 | a4913cc0ed609764c9c5ebdb46d888af332394fd8efc9be173b2795f2ac00901b3f7643d83ebd2faf0ddc5fd75df5520687daa5b85a2b9a2f9775accecb7aaa9 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 6b4f2ca3efceb2c21e93f92cdc150a9d |
| SHA1 | 2532af7a64ef4b5154752f61290dcf9ebeea290f |
| SHA256 | b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564 |
| SHA512 | 63a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-libraryloader-l1-1-0.dll
| MD5 | 3e3a777cad2aafde613836ee88179a58 |
| SHA1 | fe55ffef83601f654504f0a2256e11e1913635db |
| SHA256 | 4a02983d6632c2fb92409d56269ca9a5bb0c31d33a8f2a89b0ab847d263c3f96 |
| SHA512 | e217d4fc5bc832623cea21c86b74b97018d1bfad46e65cef36476f6e2ebec7dcfe814c0d848182e9fd8dd3cb26eef04ba9b77df394501b1d808f6cd689aa813d |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-interlocked-l1-1-0.dll
| MD5 | 7ee0013d07ed45c081df41e64ab14889 |
| SHA1 | 5f4543e008cbe86c0f14e2bfc2f803cf38d34c40 |
| SHA256 | 26f90d2086687edf6fc02be5dcfd7575faad2022c3d716cdd0b5ca3e70a3c022 |
| SHA512 | 7c083a20ea9fa3903234abc642730527ef68f96b05732d8befd8d6daf1204bfdcc51fa1996fa2fb8d532825142b4fca3fd9c4ce5be43fa9a3edc2ad8afed6c34 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-heap-l1-1-0.dll
| MD5 | 11a672968ce4879767afaf573e4ede0c |
| SHA1 | 79abb1976f249f6b45014fd692af6fca4e3ded06 |
| SHA256 | 6a803d6cbe4dcbb6e4c9e8b8945d92d7edbd1f51cfb875d3d6c312d83840dde2 |
| SHA512 | 460bb15ac2baa8d802988cc9a22ad68acf413aa1e0584c451c686ac5a86055007cc35ba0035464811179a0e0641b28a77b6a306873eb803b0719cc7857a8b9c7 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-handle-l1-1-0.dll
| MD5 | 968c1759f5d4aa2bed859a2df67acc8f |
| SHA1 | 2890a554fd106cc6572213e55c3a932be6eaadcd |
| SHA256 | 8a52a26afaf4d7cd698cf79dcd339ec3f1b3ab3c0031a8ae9064d50f63462b99 |
| SHA512 | cd903b6909d7a55e3b1b3c6894d3774bac758279bb7b62dcd6b94dc8991e98106f59dda9f3e312a1d8d3de17383d905f33bdfb96992517bcfd9b8fa52b3f7de2 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-file-l2-1-0.dll
| MD5 | adb3471f89e47cd93b6854d629906809 |
| SHA1 | 2cfc0c379fd7f23db64d15bdff2925778ff65188 |
| SHA256 | 355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69 |
| SHA512 | f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-file-l1-2-0.dll
| MD5 | 19df2b0f78dc3d8c470e836bae85e1ff |
| SHA1 | 03f2b5b848a51ee52980bf8595c559b89865de07 |
| SHA256 | bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1 |
| SHA512 | c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724 |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-file-l1-1-0.dll
| MD5 | b90485eb6d2e835f975c6f1011be880f |
| SHA1 | 714ff49459f0c0743d2d8c6784e6d28ea7f81599 |
| SHA256 | 72e79ce895ab6506d2c85bcd1709ef6a250b63c990c76c9df530ec4e5b5cbb6a |
| SHA512 | 78d09d109b3f5d796aa1f7148437a9ba49062c011fea4a0cda43ef7616176f1ad3c00aeb8b204b264e6bbd27c66afc710e221536529f0a66bf65424c52de15ae |
C:\Users\Admin\AppData\Local\Temp\_MEI48202\api-ms-win-core-errorhandling-l1-1-0.dll
| MD5 | 31990aaab1aeeae6bff96eaf3809eda9 |
| SHA1 | aa2cd6fab320643eaeb41303d5b3a802cd2365da |
| SHA256 | d71714c34fabf8a93ae316a0d8679bb8cdc843f6128c9afd42e18e0de70b1a91 |
| SHA512 | d25baf53f667d8e2239141c846a59c08636b887c8c11ba60b61992f91765c0a3cf9a993fc2017191b9cd8f0735b6c9af19bb0ecd8eff16d293f17cdc1d3b9059 |
memory/812-173-0x00007FFE55070000-0x00007FFE5714A000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2024-11-13 17:10
Reported
2024-11-13 17:13
Platform
win7-20240903-en
Max time kernel
118s
Max time network
119s
Command Line
Signatures
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2156 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2156 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2156 wrote to memory of 2056 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2056 wrote to memory of 2824 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2056 wrote to memory of 2824 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2056 wrote to memory of 2824 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2056 wrote to memory of 2824 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4lena.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\4lena.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4lena.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | 9223c628f8739e0ac15e6a54f5f88bad |
| SHA1 | 4adb8a917e58839f8d99f508fa7aab147796f445 |
| SHA256 | 161e7f403eb8d75a7d7bd452e1c6c8365bf9c4aa2f513a3a9019954a93da51f5 |
| SHA512 | 01e5f7f665b1eecfc3097dc30d9870d9ccc69ecea7c4e3c5acfc88f33a7b718f700fad7136740aa3b68547f25137904de4d3e3f0bebe40bd2b5cbf3572033143 |
Analysis: behavioral4
Detonation Overview
Submitted
2024-11-13 17:10
Reported
2024-11-13 17:13
Platform
win10v2004-20241007-en
Max time kernel
95s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4lena.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 18.134.221.88.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.236.111.52.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-13 17:10
Reported
2024-11-13 17:13
Platform
win7-20240903-en
Max time kernel
118s
Max time network
120s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2104 wrote to memory of 2124 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe |
| PID 2104 wrote to memory of 2124 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe |
| PID 2104 wrote to memory of 2124 | N/A | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe | C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe
"C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe"
C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe
"C:\Users\Admin\AppData\Local\Temp\nurikalfa.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI21042\ucrtbase.dll
| MD5 | 34168a4af676d6a5733bbf7a0905d3c7 |
| SHA1 | ba63e51ab3cd90666eb9a9bb0232502a5ec629ff |
| SHA256 | 2ab2a74bcb5bfd8248d232eb3bc56698fb5173b9ff7fc0daf87d8120d0f448d7 |
| SHA512 | c049c166b2b00dc30b0edae5d78badfffea7fb105f0cff9f3ae2c947ddf3ecde6331855b7ebed3f4ce923cc365b053b3a679319b2c6efa85ed0b9a7ddb5676ab |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\api-ms-win-core-timezone-l1-1-0.dll
| MD5 | bdd63ea2508c27b43e6d52b10da16915 |
| SHA1 | 2a379a1ac406f70002f200e1af4fed95b62e7cb8 |
| SHA256 | 7d4252ab1b79c5801b58a08ce16efd3b30d8235733028e5823f3709bd0a98bcf |
| SHA512 | b0393f0d2eb2173766238d2139ae7dea7a456606f7cb1b0e8bc0375a405bc25d28ef1c804802dddb5c3dbd88cfd047bfa5c93cbb475d1d6b5a9a893b51e25128 |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\api-ms-win-core-file-l2-1-0.dll
| MD5 | adb3471f89e47cd93b6854d629906809 |
| SHA1 | 2cfc0c379fd7f23db64d15bdff2925778ff65188 |
| SHA256 | 355633a84db0816ab6a340a086fb41c65854c313bd08d427a17389c42a1e5b69 |
| SHA512 | f53e11aa35911d226b676d454e873d0e84c189dd1caea8a0fe54d738933cd6b139eca48630f37f5979ef898950d99f3277cba6c7a697103f505d876bea62818c |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\api-ms-win-core-localization-l1-2-0.dll
| MD5 | 6b4f2ca3efceb2c21e93f92cdc150a9d |
| SHA1 | 2532af7a64ef4b5154752f61290dcf9ebeea290f |
| SHA256 | b39a515b9e48fc6589703d45e14dcea2273a02d7fa6f2e1d17985c0228d32564 |
| SHA512 | 63a42dd1cb95fd38ddde562108c78e39cb5d7c9406bf749339e717c2cd866f26268d49b6bd966b338de1c557a426a01a24c2480f64762fef587bc09d44ada53b |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\api-ms-win-core-processthreads-l1-1-1.dll
| MD5 | 247061d7c5542286aeddade76897f404 |
| SHA1 | 7285f85440b6eff8731943b73502f58ae40e95a2 |
| SHA256 | ccb974c24ddfa7446278ca55fc8b236d0605d2caaf273db8390d1813fc70cd5b |
| SHA512 | 23ef467f6bb336d3e8c38000d30a92dac68e2662891863475ff18dbddbbbce909c12d241b86dbdea085e7d19c82cd20d80a60ffb2845f6afebedf06507afe5bc |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\api-ms-win-core-file-l1-2-0.dll
| MD5 | 19df2b0f78dc3d8c470e836bae85e1ff |
| SHA1 | 03f2b5b848a51ee52980bf8595c559b89865de07 |
| SHA256 | bd9e07bbc62ce82dbc30c23069a17fbfa17f1c26a9c19e50fe754d494e6cd0b1 |
| SHA512 | c1c2b97f484e640bfdda17f7ed604d0583c3d4eaf21abf35491ccedc37fa4866480b59a692776687e5fda3eaeafb4c7bdb34dec91f996fd377a328a89c8d5724 |
C:\Users\Admin\AppData\Local\Temp\_MEI21042\python311.dll
| MD5 | d06da79bfd21bb355dc3e20e17d3776c |
| SHA1 | 610712e77f80d2507ffe85129bfeb1ff72fa38bf |
| SHA256 | 2835e0f24fb13ef019608b13817f3acf8735fbc5f786d00501c4a151226bdff1 |
| SHA512 | e4dd839c18c95b847b813ffd0ca81823048d9b427e5dcf05f4fbe0d77b8f7c8a4bd1c67c106402cd1975bc20a8ec1406a38ad4764ab466ef03cb7eb1f431c38a |