Overview
overview
10Static
static
10foo/0044d6...f7.exe
windows7-x64
1foo/0044d6...f7.exe
windows10-2004-x64
3foo/034e4c...a9.exe
windows7-x64
4foo/034e4c...a9.exe
windows10-2004-x64
4foo/035fa2...72.exe
windows7-x64
6foo/035fa2...72.exe
windows10-2004-x64
6foo/04884a...1b.exe
windows7-x64
7foo/04884a...1b.exe
windows10-2004-x64
7foo/06ed82...59.exe
windows7-x64
7foo/06ed82...59.exe
windows10-2004-x64
7foo/07470b...68.exe
windows7-x64
7foo/07470b...68.exe
windows10-2004-x64
7foo/078adb...c0.exe
windows7-x64
10foo/078adb...c0.exe
windows10-2004-x64
10foo/09e5c8...b4.exe
windows7-x64
3foo/09e5c8...b4.exe
windows10-2004-x64
3foo/0becfe...f4.exe
windows7-x64
10foo/0becfe...f4.exe
windows10-2004-x64
10foo/1a78d3...a3.exe
windows7-x64
5foo/1a78d3...a3.exe
windows10-2004-x64
7foo/1ffe82...a6.exe
windows7-x64
10foo/1ffe82...a6.exe
windows10-2004-x64
10foo/255028...e1.dll
windows7-x64
3foo/255028...e1.dll
windows10-2004-x64
3foo/27601d...cc.exe
windows7-x64
7foo/27601d...cc.exe
windows10-2004-x64
7foo/27f911...49.exe
windows7-x64
10foo/27f911...49.exe
windows10-2004-x64
10foo/28408c...c5.exe
windows7-x64
10foo/28408c...c5.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
153s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 17:46
Static task
static1
Behavioral task
behavioral1
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
foo/0044d66e4abf7c4af6b5d207065320f7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral4
Sample
foo/034e4c62965f8d5dd5d5a2ce34a53ba9.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
foo/035fa2f2fae0a8fad733686a7d9ea772.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
foo/04884a82d01d733f245d921e1f74fb1b.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
foo/06ed82e88e1f68cc08602d7cd8ec5f59.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral12
Sample
foo/07470b6ede84f02ec31ab0a601cdc068.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral14
Sample
foo/078adb95b1a0a6449d8c4ece796deac0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
foo/09e5c88a0592763e0c4f30fb88d663b4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
foo/0becfedf4d0b9ad5251aca33274a4cf4.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
foo/1a78d313f2891bd468f78694814a28a3.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral22
Sample
foo/1ffe827beb75335731cb6f052a8ec3a6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
foo/255028f2f37838e92f84f27c68aaf4e1.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
foo/27601d095e5b3761d9289584415a73cc.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
foo/27f9116902c35a9b784c703762bbd249.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
foo/28408caa2961caecd35c9f8f7c1aecc5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
foo/1a78d313f2891bd468f78694814a28a3.exe
-
Size
5.5MB
-
MD5
1a78d313f2891bd468f78694814a28a3
-
SHA1
7b10daf92b6bb599c68379909fbc951955e9335e
-
SHA256
b8953f266d0ec05808dd5ba4799986c61bfc4d6e5308b0da84cbc8afe19de4df
-
SHA512
4a9d76516888a4abff4acb29712abdc65674d5a9a3e69b0e30fa0cf815267d7d45f02d4879383232eb44c5503256af3adc4cb3db201e603816ccc983666475cb
-
SSDEEP
98304:Dmh23PSP6k8KyY/M4cX4yMltBlj6f9BkcmxPy8Wfenuy0f:DmhP8KL/M48D8Tgf9ecmBpK
Malware Config
Signatures
-
Drops file in System32 directory 38 IoCs
description ioc Process File opened for modification C:\Windows\system32\user32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\msimg32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\SspiCli.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\wsock32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\IMM32.DLL 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\SHFolder.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\MSVCP120_CLR0400.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\KERNELBASE.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\ole32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\ws2_32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\NSI.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\GDI32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\uxtheme.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\mscoree.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\dwrite.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\bcrypt.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\kernel32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\shell32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\SHLWAPI.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\rsaenh.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\api-ms-win-core-xstate-l2-1-0.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\imagehlp.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\SYSTEM32\sechost.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\MSCTF.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\CRYPTBASE.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\MSVCR120_CLR0400.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\LPK.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\advapi32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\CRYPTSP.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\dwmapi.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\version.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\psapi.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\profapi.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\USP10.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\msvcrt.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\RPCRT4.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\system32\oleaut32.dll 1a78d313f2891bd468f78694814a28a3.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
pid Process 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe -
Drops file in Windows directory 18 IoCs
description ioc Process File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\36778d2072c745f0ad72f7e219122258\System.Configuration.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\WindowsBase\6110ecf056356557d5798a1583a1c434\WindowsBase.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\8821b72d5d51079acf96e90c4af19a96\System.Xml.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b308b9c61f65cf2dfd876031ee385ba4\mscorlib.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\ceff7eae18ed09ff1116ebf9af497790\PresentationCore.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\wpfgfx_v0400.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xaml\76a6a6b0f7fb1fbd64a800b5fc3d47bb\System.Xaml.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\PresentationNative_v0400.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\nlssorting.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio1c9175f8#\7600f870ebcc661f412ab16465a64647\PresentationFramework.Aero.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System\095a3392942c3d4eb888e6a32036acd8\System.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\75913bbaf1bee617a94dcd6b5df12a5d\System.Core.ni.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\comctl32.dll 1a78d313f2891bd468f78694814a28a3.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Presentatio5ae0f00f#\3d01d2b7bde19d91d70c4ff96eea3432\PresentationFramework.ni.dll 1a78d313f2891bd468f78694814a28a3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe 2580 1a78d313f2891bd468f78694814a28a3.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeLoadDriverPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeCreateGlobalPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeLockMemoryPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: 33 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeSecurityPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeTakeOwnershipPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeManageVolumePrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeBackupPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeCreatePagefilePrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeShutdownPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeRestorePrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: 33 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeIncBasePriorityPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe Token: SeDebugPrivilege 2580 1a78d313f2891bd468f78694814a28a3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\foo\1a78d313f2891bd468f78694814a28a3.exe"C:\Users\Admin\AppData\Local\Temp\foo\1a78d313f2891bd468f78694814a28a3.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53e41edb9cbebe027b7dbe230939f5173
SHA173e1ec77ff5266d7b23f92d97bcd957188d73bc7
SHA25686fb456cee471479fa489e003467f48dc75bf21e88be1d04b17b2928278f8ac3
SHA512c2a37eb693974034d7ebfcbd81bf453ee873f22ce7cdccc5550c00ad8bcb5c5eb14d3e7208009944a57415eba7209aaba71325403575905e5e8ea9ba6ebf826c