Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 01:39

General

  • Target

    e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe

  • Size

    932KB

  • MD5

    19eb4feed67a15713b756b0335a308ed

  • SHA1

    9e3166f1040cd8345df21a48c630c4a0f4ac3c87

  • SHA256

    e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4

  • SHA512

    f667afc5f62cdf4a241cf5f53a40b95393a8d5731e982dc3ad55a0366da38c74495d4cd22f05ecb95e302b09850ebade9684ef228ae3a83b7e3acd7cf1bc90d0

  • SSDEEP

    24576:G9T4MROxnFE3GrXpErZlI0AilFEvxHiKW:G90MiukpErZlI0AilFEvxHi

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe
    "C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\trb2s6gz.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8DC0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8DBF.tmp"
        3⤵
          PID:2800
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe" --install
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:2772
      • C:\Users\Admin\AppData\Roaming\OperaWatchdog.exe
        "C:\Users\Admin\AppData\Roaming\OperaWatchdog.exe" /launchSelfAndExit "C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe" 1588 /protectFile
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1988
        • C:\Users\Admin\AppData\Roaming\OperaWatchdog.exe
          "C:\Users\Admin\AppData\Roaming\OperaWatchdog.exe" /watchProcess "C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe" 1588 "/protectFile"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {8CEBB340-90FB-4CEE-980C-DD0F0A5084A6} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe
        C:\Users\Admin\AppData\Local\Temp\e02850224e42be3bb2e7de2eccbab2fea66c18a4ee309532ca5e59350d68eae4.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2748
        • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
          "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8zc8xpz0.cmdline"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
            C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES92FD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC91D4.tmp"
            4⤵
              PID:1404
      • C:\Windows\SysWOW64\WindowsInput.exe
        "C:\Windows\SysWOW64\WindowsInput.exe"
        1⤵
        • Executes dropped EXE
        PID:604

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\8zc8xpz0.dll

        Filesize

        76KB

        MD5

        91dfd2d3f3bae2d70dac9799eaf74698

        SHA1

        927d79ceec515551eab22ea76a7f1dac656d2e30

        SHA256

        4c47ce618f6706065aaaca4fe36005d715a78020454985ca88f8553d787b22ce

        SHA512

        384f1072f4435cdfb8ec3614ffcad10b2261eead291aee86cd1747e753e177a9599ed41c03c531e72f2cf94cbf8adc73930a387ff3e0a65a04c1b16289bdc4e5

      • C:\Users\Admin\AppData\Local\Temp\RES8DC0.tmp

        Filesize

        1KB

        MD5

        401d434e62085166be2c9d146091ff32

        SHA1

        fb00d6f7ead93f05daf91e641d47012a5a33295c

        SHA256

        640a7ed29992d2219e84ae673316c2a0c66e708c016e8d8830db8107f9b82ba9

        SHA512

        5db566a32dc153cab06ebabc4a3db557a9a5d5335419d3b15a09cc8dec161ce36c7c860f5aa92be4fbba90538a6f3cb3a4bd2fc195f027c8261b0ec36236cfc8

      • C:\Users\Admin\AppData\Local\Temp\RES92FD.tmp

        Filesize

        1KB

        MD5

        9c9eec21c30110bf0d80feccc4ead380

        SHA1

        d237f06163937293c3bf866f8fd4ee3db073230d

        SHA256

        d2ed4048cf2ca5861459109c943be18c9618d059c27f20653cec9ce3255bbbed

        SHA512

        daade81976604f4163290b06c17cd4ad49914e8e184e1aeb295164f449d49e5b7fb1a28192209fa7cd450aee0b855793b503d25afda00874deb2600c034c4d91

      • C:\Users\Admin\AppData\Local\Temp\trb2s6gz.dll

        Filesize

        76KB

        MD5

        7ba6b2dc45d57c09da8d03f877af476f

        SHA1

        9000c66acb3ca213d2f83c2d57c98b4fcc46c5f7

        SHA256

        17708448168f0f85f26b1b0982bf282268e6354726c302f4877479bef2f958e9

        SHA512

        79d323bd5733dde5d9e5727405f29738ec1137f8e15cafdb07208fecefdbc69146904e67aba6dd0296af9a2d9de17c7e892b4ca25a928f839d77c12f4111bf09

      • C:\Users\Admin\AppData\Roaming\OperaWatchdog.exe

        Filesize

        9KB

        MD5

        913967b216326e36a08010fb70f9dba3

        SHA1

        7b6f8c2eb5b443e03c212b85c2f0edb9c76ad2bf

        SHA256

        8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a

        SHA512

        c6fcb98d9fd509e9834fc3fba143bd36d41869cc104fbce5354951f0a6756156e34a30796baaa130dd45de3ed96e039ec14716716f6da4569915c7ef2d2b6c33

      • C:\Windows\SysWOW64\WindowsInput.exe

        Filesize

        21KB

        MD5

        e6fcf516d8ed8d0d4427f86e08d0d435

        SHA1

        c7691731583ab7890086635cb7f3e4c22ca5e409

        SHA256

        8dbe814359391ed6b0b5b182039008cf1d00964da9fbc4747f46242a95c24337

        SHA512

        c496cf8e2e222fe1e19051b291e6860f31aae39f54369c1c5e8c9758c4b56e8af904e3e536e743a0a6fdbbf8478afba4baee92e13fc1b3073376ac6bf4a7948e

      • C:\Windows\SysWOW64\WindowsInput.exe.config

        Filesize

        357B

        MD5

        a2b76cea3a59fa9af5ea21ff68139c98

        SHA1

        35d76475e6a54c168f536e30206578babff58274

        SHA256

        f99ef5bf79a7c43701877f0bb0b890591885bb0a3d605762647cc8ffbf10c839

        SHA512

        b52608b45153c489419228864ecbcb92be24c644d470818dfe15f8c7e661a7bcd034ea13ef401f2b84ad5c29a41c9b4c7d161cc33ae3ef71659bc2bca1a8c4ad

      • \??\c:\Users\Admin\AppData\Local\Temp\8zc8xpz0.cmdline

        Filesize

        349B

        MD5

        1c856e01bc351be2b55f4039fb274f77

        SHA1

        ab709950e2514ff4c46047a43b30ef5d7b355973

        SHA256

        33bb84dae805a7e504960929df0ae4eaf6ace793b1b898b0d06a73caac3d86cb

        SHA512

        7e6ee5df05fb9e1e16e7fa5745ce6e4f4c8e4c65526c4623077c8b6dd1b72de6aab5f16ec61b88cb5b8edf8ddb501872b2acb516983093daf26f81520729c48f

      • \??\c:\Users\Admin\AppData\Local\Temp\CSC8DBF.tmp

        Filesize

        676B

        MD5

        897f7bb7e2fba8ae5910d47b36e178a8

        SHA1

        83f4bf40c596f1fe26cbb38bad9e5945d9e9e4ce

        SHA256

        66fdc61dde2407211f8aa7ee85a288d87a1cd3d066a42cabda978251fcfddf43

        SHA512

        55f82011f138813ed688d763fe623213ec043707e7e8cee95f39e8f537b00bc513639a6a9ce97eb44ed7a612ab1aeb9374d174ca76f696fa7536453cee774dad

      • \??\c:\Users\Admin\AppData\Local\Temp\CSC91D4.tmp

        Filesize

        676B

        MD5

        e72619d80717c76d2f71fc762680bf1e

        SHA1

        aa202acda5635c385f94709f0cf9ac43a22fae28

        SHA256

        d02e56babf536040e95bd01edf80b3c4972dedaec8be1acf20516f6a390cc82e

        SHA512

        487b411ce34e530630152935a333ecc5ba2bb77ee5afdbdcc16eaf5bf236517168dd312e790ca45e8c4026b2ba9c05ff21c7ad921a985558edcd55021cb2ff30

      • \??\c:\Users\Admin\AppData\Local\Temp\trb2s6gz.0.cs

        Filesize

        208KB

        MD5

        2b14ae8b54d216abf4d228493ceca44a

        SHA1

        d134351498e4273e9d6391153e35416bc743adef

        SHA256

        4e1cc3da1f7bf92773aae6cffa6d61bfc3e25aead3ad947f6215f93a053f346c

        SHA512

        5761b605add10ae3ef80f3b8706c8241b4e8abe4ac3ce36b7be8a97d08b08da5a72fedd5e976b3c9e1c463613a943ebb5d323e6a075ef6c7c3b1abdc0d53ac05

      • \??\c:\Users\Admin\AppData\Local\Temp\trb2s6gz.cmdline

        Filesize

        349B

        MD5

        f151dd8df0bdacff442f346566714e8b

        SHA1

        27049d0c081302f9c9f166849ad18650ffdf76c7

        SHA256

        a79228775b3ec3aa2f9db9808d7e1a9a7a785499e0bbb5b31e61946041c3e9c3

        SHA512

        298f3a9340964ec0087adf548bc7daf3c6ba28a05eb3123457e796abc020f9f8b8f8ba1b4cc5b4bd72c445274dada05b80fd9bbab662620873c753d40db07abd

      • memory/604-50-0x0000000000390000-0x000000000039C000-memory.dmp

        Filesize

        48KB

      • memory/1052-10-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1052-17-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-3-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-2-0x0000000000A40000-0x0000000000A4E000-memory.dmp

        Filesize

        56KB

      • memory/1588-26-0x000000001B330000-0x000000001B37E000-memory.dmp

        Filesize

        312KB

      • memory/1588-27-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-22-0x00000000011F0000-0x00000000011F8000-memory.dmp

        Filesize

        32KB

      • memory/1588-23-0x0000000001200000-0x0000000001208000-memory.dmp

        Filesize

        32KB

      • memory/1588-71-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-7-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-70-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-19-0x000000001AFB0000-0x000000001AFC6000-memory.dmp

        Filesize

        88KB

      • memory/1588-21-0x0000000000A70000-0x0000000000A82000-memory.dmp

        Filesize

        72KB

      • memory/1588-1-0x000000001AF30000-0x000000001AF8C000-memory.dmp

        Filesize

        368KB

      • memory/1588-0-0x000007FEF60EE000-0x000007FEF60EF000-memory.dmp

        Filesize

        4KB

      • memory/1588-54-0x000000001B600000-0x000000001B618000-memory.dmp

        Filesize

        96KB

      • memory/1588-55-0x000000001AFD0000-0x000000001AFE0000-memory.dmp

        Filesize

        64KB

      • memory/1588-56-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-24-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-69-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1588-67-0x000007FEF60EE000-0x000007FEF60EF000-memory.dmp

        Filesize

        4KB

      • memory/1588-68-0x000007FEF5E30000-0x000007FEF67CD000-memory.dmp

        Filesize

        9.6MB

      • memory/1988-65-0x0000000001140000-0x0000000001148000-memory.dmp

        Filesize

        32KB

      • memory/2748-52-0x0000000000710000-0x0000000000726000-memory.dmp

        Filesize

        88KB

      • memory/2772-35-0x0000000000DD0000-0x0000000000DDC000-memory.dmp

        Filesize

        48KB