Overview

overview

8

Static

static

3

ea0a7bf19b...e3.exe

windows7-x64

8

ea0a7bf19b...e3.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 10:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ea0a7bf19b8aecbcff2ad2e5e2836873021a73e5b70787a43e71a274448a4be3.exe
  • Size 90KB
  • Sample241121-mylpfa1ckf
  • SHA256 ea0a7bf19b8aecbcff2ad2e5e2836873021a73e5b70787a43e71a274448a4be3
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Executes dropped EXE 12 IoCs
  • Drops file in Windows directory 12 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea0a7bf19b8aecbcff2ad2e5e2836873021a73e5b70787a43e71a274448a4be3.exe
    "C:\Users\Admin\AppData\Local\Temp\ea0a7bf19b8aecbcff2ad2e5e2836873021a73e5b70787a43e71a274448a4be3.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Windows\{92FBF5A8-B39C-4f50-8F83-8A5C98DC3C0E}.exe
      C:\Windows\{92FBF5A8-B39C-4f50-8F83-8A5C98DC3C0E}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Windows\{BDF329F9-7BD2-4d3d-A03F-7A10CED970A8}.exe
        C:\Windows\{BDF329F9-7BD2-4d3d-A03F-7A10CED970A8}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1808
        • C:\Windows\{9F34C95E-0E33-4aac-B072-20BA1EF192B8}.exe
          C:\Windows\{9F34C95E-0E33-4aac-B072-20BA1EF192B8}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\Windows\{49955295-9068-4343-B397-0663942DC2D2}.exe
            C:\Windows\{49955295-9068-4343-B397-0663942DC2D2}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1020
            • C:\Windows\{8F699837-4BDC-4404-BAD3-6B23A6535250}.exe
              C:\Windows\{8F699837-4BDC-4404-BAD3-6B23A6535250}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Windows\{1A50AFCA-B304-4ca4-A27C-30D80354DFD1}.exe
                C:\Windows\{1A50AFCA-B304-4ca4-A27C-30D80354DFD1}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3636
                • C:\Windows\{CFAF1A36-3C4B-4bae-B230-E4BB1F2C5B3C}.exe
                  C:\Windows\{CFAF1A36-3C4B-4bae-B230-E4BB1F2C5B3C}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2764
                  • C:\Windows\{893AFBCE-AC07-4f7a-B79E-DF114766AAAC}.exe
                    C:\Windows\{893AFBCE-AC07-4f7a-B79E-DF114766AAAC}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:4332
                    • C:\Windows\{8D835F58-E370-47ed-8F45-17510102F1C9}.exe
                      C:\Windows\{8D835F58-E370-47ed-8F45-17510102F1C9}.exe
                      10⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Executes dropped EXE
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:4520
                      • C:\Windows\{63A7F918-9E87-47d8-87C0-F49BCB3D2A29}.exe
                        C:\Windows\{63A7F918-9E87-47d8-87C0-F49BCB3D2A29}.exe
                        11⤵
                        • Boot or Logon Autostart Execution: Active Setup
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1532
                        • C:\Windows\{2E928475-48E4-4c07-B1F0-7000975E9677}.exe
                          C:\Windows\{2E928475-48E4-4c07-B1F0-7000975E9677}.exe
                          12⤵
                          • Boot or Logon Autostart Execution: Active Setup
                          • Executes dropped EXE
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4776
                          • C:\Windows\{A63997A2-2CBF-45a1-81E1-61002F631C38}.exe
                            C:\Windows\{A63997A2-2CBF-45a1-81E1-61002F631C38}.exe
                            13⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:3792
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c del C:\Windows\{2E928~1.EXE > nul
                            13⤵
                            • System Location Discovery: System Language Discovery
                            PID:4004
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c del C:\Windows\{63A7F~1.EXE > nul
                          12⤵
                          • System Location Discovery: System Language Discovery
                          PID:4744
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c del C:\Windows\{8D835~1.EXE > nul
                        11⤵
                        • System Location Discovery: System Language Discovery
                        PID:4512
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{893AF~1.EXE > nul
                      10⤵
                      • System Location Discovery: System Language Discovery
                      PID:4380
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c del C:\Windows\{CFAF1~1.EXE > nul
                    9⤵
                    • System Location Discovery: System Language Discovery
                    PID:4296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c del C:\Windows\{1A50A~1.EXE > nul
                  8⤵
                  • System Location Discovery: System Language Discovery
                  PID:4436
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c del C:\Windows\{8F699~1.EXE > nul
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4472
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del C:\Windows\{49955~1.EXE > nul
              6⤵
              • System Location Discovery: System Language Discovery
              PID:2180
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c del C:\Windows\{9F34C~1.EXE > nul
            5⤵
            • System Location Discovery: System Language Discovery
            PID:4648
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c del C:\Windows\{BDF32~1.EXE > nul
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3788
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c del C:\Windows\{92FBF~1.EXE > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1320
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EA0A7B~1.EXE > nul
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4084

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        {1A50AFCA-B304-4ca4-A27C-30D80354DFD1}.exe
        • Path C:\Windows\{1A50AFCA-B304-4ca4-A27C-30D80354DFD1}.exe
        • Size 90KB
        • SHA256 5f0df8aceb1b1c8ea784e5d70035f8f4c0f660e0596eb5ddbb7b5c17613c3140
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {2E928475-48E4-4c07-B1F0-7000975E9677}.exe
        • Path C:\Windows\{2E928475-48E4-4c07-B1F0-7000975E9677}.exe
        • Size 90KB
        • SHA256 61f0bb579b54d4e45896bf4e3dd78ca715cd2207f1c7fe6fa57e605b3b2a35e7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {49955295-9068-4343-B397-0663942DC2D2}.exe
        • Path C:\Windows\{49955295-9068-4343-B397-0663942DC2D2}.exe
        • Size 90KB
        • SHA256 97c573b59ba6d3a9944fb8a78b258857abb85508ded81e57c95c17aa5b2dc8d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {63A7F918-9E87-47d8-87C0-F49BCB3D2A29}.exe
        • Path C:\Windows\{63A7F918-9E87-47d8-87C0-F49BCB3D2A29}.exe
        • Size 90KB
        • SHA256 a5894ea914f6d00152eba35450fdfa7d96e8ac8befda86a02583bf9db7a515b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {893AFBCE-AC07-4f7a-B79E-DF114766AAAC}.exe
        • Path C:\Windows\{893AFBCE-AC07-4f7a-B79E-DF114766AAAC}.exe
        • Size 90KB
        • SHA256 2445a588097b328c0a9323d70939ff4feb150a691323b8dfe8a9be9406b1bed4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {8D835F58-E370-47ed-8F45-17510102F1C9}.exe
        • Path C:\Windows\{8D835F58-E370-47ed-8F45-17510102F1C9}.exe
        • Size 90KB
        • SHA256 8d57da5e3d3b57dbb45c17c4a3dddac5f728723e97828e9e7b45dff7d5913aee
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {8F699837-4BDC-4404-BAD3-6B23A6535250}.exe
        • Path C:\Windows\{8F699837-4BDC-4404-BAD3-6B23A6535250}.exe
        • Size 90KB
        • SHA256 2525b651fca5a3aa094aae179d321f2b4123287798f9c574c98368b48110b8b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {92FBF5A8-B39C-4f50-8F83-8A5C98DC3C0E}.exe
        • Path C:\Windows\{92FBF5A8-B39C-4f50-8F83-8A5C98DC3C0E}.exe
        • Size 90KB
        • SHA256 af5de948a3b6dd0fef7221ec84ef8858620c6099ad8d4fab7181f993874aa1ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {9F34C95E-0E33-4aac-B072-20BA1EF192B8}.exe
        • Path C:\Windows\{9F34C95E-0E33-4aac-B072-20BA1EF192B8}.exe
        • Size 90KB
        • SHA256 9835cae7ee65b3214d43032751c73f3e14286fbb51b4757a2e7e3416d55f0ead
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {A63997A2-2CBF-45a1-81E1-61002F631C38}.exe
        • Path C:\Windows\{A63997A2-2CBF-45a1-81E1-61002F631C38}.exe
        • Size 90KB
        • SHA256 d3ab81c6878ba9a43c07d1047acdc1dfe9e6c5cab4cecfe14cd5ca38277725b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {BDF329F9-7BD2-4d3d-A03F-7A10CED970A8}.exe
        • Path C:\Windows\{BDF329F9-7BD2-4d3d-A03F-7A10CED970A8}.exe
        • Size 90KB
        • SHA256 60c06208775341e91d75ddbe79abb387c18a30483553306d43bc9a3bab19da8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        {CFAF1A36-3C4B-4bae-B230-E4BB1F2C5B3C}.exe
        • Path C:\Windows\{CFAF1A36-3C4B-4bae-B230-E4BB1F2C5B3C}.exe
        • Size 90KB
        • SHA256 1ce5c1d9dfb4c952e72b8f1480af6d6bf0fe9e3cda51d5794761139725b88d6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download