bbbedd933ac156b476e1b3edb3e09501c604a79c4ff1a917df779a9f1bec5cca

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2024, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 5.2MB
Sample241128-g53cwaylez
SHA256 bbbedd933ac156b476e1b3edb3e09501c604a79c4ff1a917df779a9f1bec5cca
MD5 9603cad726f04b638b9797c46c162077
SHA1 4a014126222d142651b17f45dbba0e8921824908
SHA512 ed5a6aad1d4a4a1ca52db49e05f7182cbaaa1b0f529e8f365ce88c5e6119c5295efc93ba858b965439c7128cbcd95bd0dda7aea27fa0aa99e25275a1dfd1963f
SSDEEP 98304:+1dJnYn26LSFNG454AmJ7icauHrXMU8LGfHeCXX3XWDW1tTf3HhKM26:+rJn0O54A07PauHr8U8WeCXX3aED3BzJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	file.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
232	file.exe
232	file.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4340	file.exe
4340	file.exe
4340	file.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4340	file.exe
4340	file.exe
4340	file.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 232	3852	file.exe	82
PID 3852 wrote to memory of 232	3852	file.exe	82
PID 3852 wrote to memory of 232	3852	file.exe	82
PID 3852 wrote to memory of 4340	3852	file.exe	83
PID 3852 wrote to memory of 4340	3852	file.exe	83
PID 3852 wrote to memory of 4340	3852	file.exe	83

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe" --local-service
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:232
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe" --local-control
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gcapi.dll

Path C:\Users\Admin\AppData\Local\Temp\gcapi.dll
Size 385KB
SHA256 73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf
MD5 1ce7d5a1566c8c449d0f6772a8c27900
SHA1 60854185f6338e1bfc7497fd41aa44c5c00d8f85
SHA512 7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753
SSDEEP 6144:Tv/ioKdMF+LZD/ZRj1vwWrrUFMNoz4pFGxjEB1NYAOrabN2GZvFcD7:Td+LZrNwWrrwMNoz4vG1OYZabtK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 4KB
SHA256 48c87bff65ebfa22fd059981e6935e793e93c2c7e9e55369b11a11d7a8f5e725
MD5 ee4f350ce0955f76ba364e5bec420a1f
SHA1 e8d5f48bb2c5ada00b4ecbb92cc9c087910480cb
SHA512 1cf02cb041d3486c69907be8194af925984523d73b3a21c44029df5b0a5f4d82b70cbe85331f7663474e013f58d52cb52cb728172ad40f467c75f62ea1c7002f
SSDEEP 96:iDuCjFGiNF1ybh3Al0xi8Xk5o2vNqzipz1N10e1N1k1S1BK0Wj9YwXa/JX:iDuCjFGiv8bxAl0xi4k62vNTpzPyeL62
MD5 SHA1 SHA512 SSDEEP

Submit Download

ad.trace

Path C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Size 9KB
SHA256 2398651a7229f26e4977bf814b83bc4eabb07c0950190e6d9a1cda4060ab91cf
MD5 409d1e2eb2e693ff6e41d6fb96194eca
SHA1 ef2b11ab58de75410fda5ef4ee9d21c86c86f67d
SHA512 f4fc62dd98920670ea871eb20c29f5854fa5f31978fd03c197c8d813f8b3d754521ab509cba9ef06bd9f535ad53adfbe0968860bd430e7bb223accbc6b6a4849
SSDEEP 192:iDuCjFGiv8bxAl0xi4k62vNTpzPyeL6ArBWj9YwKRl34c31MeEZ070fuxfON0da1:qS2qWTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 2KB
SHA256 87db2af482827cfd227ede58826b5c3644d7731ca1114acc4e1692ac3a0f3fb3
MD5 2f762fed631c9fe197f81ec381ba4a42
SHA1 3445f2cdd43ba118e424e637d46a69714aaa1025
SHA512 9c34f0c225c6906f23c50821975e9f68bec80ed4699a7f5bcbd6998a117e9276fd502a3c7ecc5073617ce737ccf2e2d5d18012ac627eb01160cb845e9c939f20
MD5 SHA1 SHA512

Submit Download

service.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf
Size 2KB
SHA256 3fa6030c4f0a7dc156a734c836d408503d9362f02d2c894ed6ddf7217e9e0bfb
MD5 fc7872b9936cac3dd056611f834c9ae3
SHA1 3b4569a0c58cba8dfa44e8dcd9483a014733870b
SHA512 f7ccd17495856cfd31b185c693409731d34e8824a4f1d9b88593e1c29ca3f590e1310b109e25a1ad76d27d34c6c5fee9e2fc35bb2e9252d61bec80202a7653de
MD5 SHA1 SHA512

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 681B
SHA256 40f97817c2137bc3ed614d80c7c4a2738e50b0aace99f70dc343d7e0fbdf8917
MD5 79b0e8e2007c8377bf500680ad20f4af
SHA1 39df3e13e7e7a48daea7efb745cd11973af07acb
SHA512 a4a168e119ed95ba8b894a2104e0e9cb4688624224cccf891d4ed946911dfd6d0c4f08278a7dcf251d652924e6cdbf96ca79b09fb1220342ef1bd1cf686d85c6
MD5 SHA1 SHA512

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 738B
SHA256 fefe607f0da7892ccd80b37671895adb27523b8936391a32b854b10f5854b362
MD5 5d9778abd055b0c9cbe54013bb8a437b
SHA1 e1c87efcae1f940517bd4cd7fb0193c8120efd3e
SHA512 9adad986e1ba2fcd69174011ac6ccdc350dab08a2dca345f821936d8cf8c185391a360aa727ac8c5ec7f75869e1f466b4ca4d8eb03aa3510297e763d1d3b7146
MD5 SHA1 SHA512

Submit Download

system.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf
Size 424B
SHA256 73b8ea5b337ab192374e42f6f1deab49594120f0fcf4750ab4d58852c3b707b8
MD5 4e7be9e9c62c50dc7188846c64ebd221
SHA1 a12b9ba73bb10155317f2317be186150d60ac465
SHA512 904be13d52681ea3fc26718f2e9076f01fde5ece4941986693911767780acac6b9635914a977d2433716b4f3f44e34079ddda822d8ad3a54656e8893af7587c0
MD5 SHA1 SHA512

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 6KB
SHA256 45cbdf97216c7d11a105e182b0c57034ab7fe1650a715ecbc0a26ac5dfcb86d9
MD5 3c00152edfe1eb220bf36df0d25a2030
SHA1 361076a45f61537620c630babc70bd4554be0cb8
SHA512 de1e011bebdf6a6d64faa3d20d6c01c5d892f39ede6c897c0d475f0e83cc444afd84b02c407c716faf711dda44fc0b8b0284f59b6626d3e7b6ca80fbd7727d61
SSDEEP 96:PmFaYB3QzOG7nzixnhu2NxCeKBEzGc2WhhtlJzCTzaAGwIs8bjCntC1mrX7:548OzGQt6HFIs8cImrX7
MD5 SHA1 SHA512 SSDEEP

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 6KB
SHA256 482909730027d762bc8d892ef40fc3f86fd3a504be0d1102e447756bbb0111a9
MD5 29d4e3b0fac1d027ebf69923c8db6a1a
SHA1 1494765c5b211b854b03cd53abb0f776ca309469
SHA512 e3c2255feb882b1373eb58106923d9817b199b0c7bdff0b82d3304ddfa02dd54a0458741bbfe4c6b272a1d694c48273e40767f262177dde1d3eee2a89292be7a
SSDEEP 96:PmFaYB3QzOG7nzixnhu2NxCeKBEzGc2WhhtlJzCTzaAGwIs8bjCntC1mrXZx:548OzGQt6HFIs8cImrXZx
MD5 SHA1 SHA512 SSDEEP

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 6KB
SHA256 f35fa47f6d236dbbb241fe04f1585bdc35ad1a65e9a2fd0fc177c2a6aa5f87da
MD5 fd6474337ff70adb061b83135564594f
SHA1 54d1ad5c5b33462dc92df049520ea9d5d24b618a
SHA512 c7311a763807622d465297802d8fa09a51248813374db5ec5210ed88414407f6b21af599dbe5bc38b1d19549d9764f563b42fc613eee8a6c17109814cfb2e933
SSDEEP 96:PmFaYB3QzOG7nzixnhu2NxCeKBEzGc2WhhtlJzCTzaAGwIs8bjCntC1mrXWJ8:548OzGQt6HFIs8cImrXWJ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 7KB
SHA256 81b69386fcd4ee65df8bcd95f7e23927fc042d0535a31beea5f1167c118a6c94
MD5 e67eb6e307a7748f8cfcca0e33e56a97
SHA1 1bf712fcab9c5fcb11e6b313ef86adf07fe94f99
SHA512 2be3742b5a182e852a1b728fbd556ee749bdb2047d67423ab8946be7069c0c279cb1250fa827fdeaafa1ef326008b27d19981ac447b1f491ca9de63dfb5329aa
SSDEEP 96:PmFaYB3QzOG7nzixnhu2NxCeKBEzGc2WhhtlJzCTzaAGwIs8bjCntC1mrXEXcJsK:548OzGQt6HFIs8cImrXEXcJsK
MD5 SHA1 SHA512 SSDEEP

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 6222c45d9a9ee46ffe4570a22f0a212bd4f8173060c92b9cfa51ef1c519cb116
MD5 58073178463f9937513ccda5014e5241
SHA1 63406c746fd16c8ec19c12d62ced5fda6d84dd8d
SHA512 a514b78dd59f76bfb289bb892f1f48ce58d2eaae1142ad8a72962ab543195a024f89a6e7b293aa3ec340409ce3efd8341a0ae533488336b9f812dd62fdb921c6
MD5 SHA1 SHA512

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 98f2e232a1c5d8dfd2c02df1f647282dc285e7b3432e86827dd034ca2d995c78
MD5 8e349783832e8deb29d1be3f1dc529f9
SHA1 3a0322211b757cb8aa21207ba81a98a5088dc8ca
SHA512 ef424ca9cd7a815e3f51f268d81fff46593426d2a310063d77477a662e31e00d3f331c1933132cba3f76a574b1418b369ac0f9013fa72ce3353f36b9077dfe03
MD5 SHA1 SHA512

Submit Download

user.conf

Path C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Size 1KB
SHA256 63f9aaf84c10c0afb8950d5f04329778cc10cbb36471b3cc9106914bc7b044c6
MD5 b0069cb0752e098845648efae872ab3a
SHA1 fa1e03f8192ed6b4e167e273eef7480619fa80d2
SHA512 73520316754c3ab567510a7905b72ecc2e719cf557b78a48247069c45fff23ce4b7b8697f9ae779ba72573ecd368fa87624f14a5047a83778e8b648e9e1fca64
MD5 SHA1 SHA512

Submit Download

memory/232-208-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/232-11-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/3852-207-0x0000000000364000-0x00000000015C6000-memory.dmp

Download

memory/3852-1-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/3852-0-0x0000000000364000-0x00000000015C6000-memory.dmp

Download

memory/3852-206-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/3852-8-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/4340-13-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download

memory/4340-209-0x0000000000360000-0x0000000001AFD000-memory.dmp

Download