Overview
overview
10Static
static
830bc4934d7...f0.exe
windows7-x64
6338fdf3626...13.exe
windows7-x64
1342933cb4c...20.exe
windows7-x64
9343ace5874...03.exe
windows7-x64
834818CE171...49.dll
windows7-x64
8360390_crypt.exe
windows7-x64
4360390_tree.cmd
windows7-x64
73896f8a370...e_.exe
windows7-x64
73a061ee07d...8c.dll
windows7-x64
33af4fa2bff...d1.dll
windows7-x64
33bb691982d...21.exe
windows7-x64
93e3f980ab6...95.exe
windows7-x64
73e3f980ab6...26.exe
windows7-x64
73e75e8238a..._2.exe
windows7-x64
6400cad56ff...9a.exe
windows7-x64
940b3cb2a21...0c.exe
windows7-x64
9425c42d610...5F.exe
windows7-x64
7425c42d610...FF.exe
windows7-x64
742d77128db...e7.exe
windows7-x64
74561647.exe
windows7-x64
9457C9141EC...C8.exe
windows7-x64
1046a9660c57...83.exe
windows7-x64
346ca6b1972...FB.exe
windows7-x64
746ca6b1972...FC.exe
windows7-x64
74e60f3c8ea...5b.exe
windows7-x64
84f0b660543...B3.exe
windows7-x64
74f0b660543...BB.exe
windows7-x64
74f5bff6416...09.exe
windows7-x64
7Versamento...__.exe
windows7-x64
94fda5e7e8e...00.exe
windows7-x64
75 Rules for Snort.doc
windows7-x64
7502de64ee4...c2.exe
windows7-x64
9Analysis
-
max time kernel
1790s -
max time network
1563s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:21
Behavioral task
behavioral1
Sample
30bc4934d7e29c8c4c4c9be0510fc7558fddf8db666a0343784c5cf1587b3af0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
338fdf3626aa4a48a5972f291aacf3d6172dd920fe16ac4da4dd6c5b999d2f13.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
342933cb4cbb31a2c30ac1733afc318a6e5cd0226160a59197686d635ec71b20.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
34818CE171EA150B91429AC1DD6FBE49.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
360390_crypt.exe
Resource
win7-20240903-en
Behavioral task
behavioral7
Sample
360390_tree.cmd
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
3896f8a37034429e9784d767765d85ef6dcde105320568516fac4e31400514db.exe_.exe
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
3a061ee07d87a6bb13e613e000e9f685cbffb96bd7024a9e7b4cb0be9a4af38c.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
3af4fa2bffaab37fd557ae8146ae0a29ba0faf6d99ad8a1a8d5bf598ac9a23d1.dll
Resource
win7-20241010-en
Behavioral task
behavioral11
Sample
3bb691982de416a7a4e57b91211e80bea82dcca7b4bdbf25c0c80451dc138421.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_Dumped_TDS=4FBA3695.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
3e3f980ab668ccde6aafee60ce16e3c35cd91e9b59bff20ce1615d5fb362a458_TDS=4FBADA26.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
3e75e8238a6bbd8817164658696198af_72889f61171de37d6b4d59016c55ec52__2.exe
Resource
win7-20240903-en
Behavioral task
behavioral15
Sample
400cad56ff3d210346cf6c4795aeb607e5b211b3dc4a8421b9437621c254239a.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
40b3cb2a210fafdaabdebefe1430862bd1192a80fcde84f51ceb387136d1410c.exe
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_Dumped_TDS=4F8C315F.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
425c42d6108db6b6b5cbda7a5417b5f55225c47ac588f5f0a293c2b07a78d14b_TDS=4F9906FF.exe
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
4561647.exe
Resource
win7-20241010-en
Behavioral task
behavioral21
Sample
457C9141ECDD9E9CFC61551FEA2BCB86AFF56CC8.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
46a9660c57e244636a28df62e0879300a62552ab9b5cfd4708ff677af7453883.exe
Resource
win7-20240903-en
Behavioral task
behavioral23
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_Dumped_TDS=4FB252FB.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
46ca6b1972c81eab77202146184afe95b797bd4e3788c59e8036e748b55fc28c_TDS=4FB566FC.exe
Resource
win7-20240729-en
Behavioral task
behavioral25
Sample
4e60f3c8eaa0441d4ffdced18aa04153bb91b5470bc5441ba5878f7760ca9b5b.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_Dumped_TDS=4F9911B3.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
4f0b6605434c1355b10950024eaa9f695822278f57c29275706c0e5b29b369b0_TDS=4FA6FBBB.exe
Resource
win7-20241010-en
Behavioral task
behavioral28
Sample
4f5bff64160044d9a769ab277ff85ba954e2a2e182c6da4d0672790cf1d48309.exe
Resource
win7-20240729-en
Behavioral task
behavioral29
Sample
Versamento.Pdf______________________________________________________________.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
4fda5e7e8e682870e993f97ad26ba6b2.000.exe
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
5 Rules for Snort.doc
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
502de64ee4fe0133a1ea5efa4919c03bbca1adc2.exe
Resource
win7-20240903-en
General
-
Target
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
-
Size
510KB
-
MD5
565dacda99cc8d28d3e650b4d85e8d24
-
SHA1
6c5f2ab498ae16332a3863e45d35e47e1aabe001
-
SHA256
343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303
-
SHA512
534eeda2e7c99ffef2bf023aa3f68739953ecbdfabcd57ad41af08c8c563fe27f7f8be04e80bdc2904ed0632984968551ddb107917fbe6dfc7a0e704af313946
-
SSDEEP
12288:M7iBDowvTfS6ublBri5g3D7eJit/mUZ5jI0B57g3l1TV0:/EkStbjfdteUZ+0BQ7TV
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe\Debugger = "alg.exe" SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe\Debugger = "alg.exe" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe SURVEY~2.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe\Debugger = "alg.exe" SURVEY~2.EXE -
Executes dropped EXE 1 IoCs
pid Process 2692 SURVEY~2.EXE -
Loads dropped DLL 1 IoCs
pid Process 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe -
Modifies system executable filetype association 2 TTPs 11 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command SURVEY~2.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\oobe\info\backgrounds\backgroundDefault.jpg SURVEY~2.EXE File created C:\Windows\system32\oobe\info\backgrounds\backgroundDefault.jpg SURVEY~2.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SURVEY~2.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main SURVEY~2.EXE Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch SURVEY~2.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" SURVEY~2.EXE -
Modifies registry class 13 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.exe SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open SURVEY~2.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command SURVEY~2.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2692 SURVEY~2.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2692 SURVEY~2.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2692 SURVEY~2.EXE 2692 SURVEY~2.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2096 wrote to memory of 2692 2096 343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe 30 PID 2692 wrote to memory of 2536 2692 SURVEY~2.EXE 31 PID 2692 wrote to memory of 2536 2692 SURVEY~2.EXE 31 PID 2692 wrote to memory of 2536 2692 SURVEY~2.EXE 31 PID 2692 wrote to memory of 2536 2692 SURVEY~2.EXE 31 PID 2692 wrote to memory of 1692 2692 SURVEY~2.EXE 32 PID 2692 wrote to memory of 1692 2692 SURVEY~2.EXE 32 PID 2692 wrote to memory of 1692 2692 SURVEY~2.EXE 32 PID 2692 wrote to memory of 1692 2692 SURVEY~2.EXE 32 -
System policy modification 1 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1" SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1" SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1" SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" SURVEY~2.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1" SURVEY~2.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SURVEY~2.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe"C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE2⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2692 -
C:\Windows\SysWOW64\cmd.execmd /c "ftype asriel=alg "%1""3⤵
- System Location Discovery: System Language Discovery
PID:2536
-
-
C:\Windows\SysWOW64\cmd.execmd /c "assoc .exe=asriel"3⤵
- System Location Discovery: System Language Discovery
PID:1692
-
-
-
C:\Windows\system32\alg.exealg.exe explorer.exe1⤵PID:2716
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5ec974d8dcb26e1462ef53a780acbeeaf
SHA1edcaf178d0e5697967363e9e91a11ac01e9351e0
SHA25630ad9f411bdf68fb4e683326d167c6e098e800438ae87fa48401ef918c45b81a
SHA512159e01452fbb09d92ce3bf0059bf14d9acd956e0ceb7e7b9a0f7311e0432bfc0b232a4102a4ffe6f539200440eb44cf1f421385dcdc3411596d48b0d7e6f5694
-
Filesize
107KB
MD56a0c11b9977e9aca6083bd5f7ed7d501
SHA1cec8b3eaa2a8ff74a447a69c23afffde6e7bb278
SHA256d4cbab9fbfe4f58322dde41ced37c68288c94334399a50daa559898679dab188
SHA51228a3f1993d2af4e6e7fcace42d34401d983ce46d897e257c314519e7c132897bb1cdc377fef48889efbecb93c3a85ab0629cd400f3905341a4415f428a928c85
-
Filesize
381KB
MD59fb609d65c73bf9d91ba19dd35b02fd3
SHA1081e3cdf4ff535fde9861b5941d461f1c0b8e8ef
SHA256a559cc64348b108b1d6bc4194cd05c7e23d72aed07fe469f1ca175e4405a873b
SHA5124d3bac285e9529895583c07cc885d0f1d38586e477513f9f66f3a7da2b9c3280706feb1391b491f18fcb3385316a1e86151a80cac3a73a7c16999c405e2ba89b