Overview
overview
5Static
static
4#Pa$$w0rD_...#$.zip
windows7-x64
1#Pa$$w0rD_...#$.zip
windows10-2004-x64
1#Pa$$w0rD_...p#$.7z
windows7-x64
1#Pa$$w0rD_...p#$.7z
windows10-2004-x64
1Resources/...w.phpt
windows7-x64
3Resources/...w.phpt
windows10-2004-x64
3Resources/...1.phpt
windows7-x64
3Resources/...1.phpt
windows10-2004-x64
3Resources/...8.phpt
windows7-x64
3Resources/...8.phpt
windows10-2004-x64
5Resources/...g.phpt
windows7-x64
3Resources/...g.phpt
windows10-2004-x64
3Resources/...007.js
windows7-x64
3Resources/...007.js
windows10-2004-x64
3Resources/...3.phpt
windows7-x64
3Resources/...3.phpt
windows10-2004-x64
3Resources/...007.js
windows7-x64
3Resources/...007.js
windows10-2004-x64
3Resources/...4.phpt
windows7-x64
3Resources/...4.phpt
windows10-2004-x64
3Resources/...01.ps1
windows7-x64
3Resources/...01.ps1
windows10-2004-x64
3Resources/...oard.h
windows7-x64
3Resources/...oard.h
windows10-2004-x64
3Resources/...6.phpt
windows7-x64
3Resources/...6.phpt
windows10-2004-x64
3Resources/...8.phpt
windows7-x64
3Resources/...8.phpt
windows10-2004-x64
3Resources/...1.phpt
windows7-x64
3Resources/...1.phpt
windows10-2004-x64
3Resources/...6/htwj
windows7-x64
1Resources/...6/htwj
windows10-2004-x64
1Analysis
-
max time kernel
95s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
06-01-2025 08:53
Behavioral task
behavioral1
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
#Pa$$w0rD__6654--0peɴ_Set-Up#$.7z
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Resources/Data/x64/r4_groupH_simple_rpcenc_017w.phpt
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Resources/Data/x64/r4_groupH_simple_rpcenc_017w.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Resources/Data/x64/schema041.phpt
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Resources/Data/x64/schema041.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Resources/Data/x64/ssa_bug_008.phpt
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Resources/Data/x64/ssa_bug_008.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Resources/Data/x64/template_cloning.phpt
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Resources/Data/x64/template_cloning.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Resources/Data/x64/try_multicatch_007.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Resources/Data/x64/try_multicatch_007.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Resources/Data/x64/x86/T33.phpt
Resource
win7-20241023-en
Behavioral task
behavioral16
Sample
Resources/Data/x64/x86/T33.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Resources/Data/x64/x86/bug64007.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Resources/Data/x64/x86/bug64007.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Resources/Data/x64/x86/bug72094.phpt
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Resources/Data/x64/x86/bug72094.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Resources/Data/x64/x86/foreachLoop.001.ps1
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Resources/Data/x64/x86/foreachLoop.001.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Resources/Data/x64/x86/fpm_scoreboard.h
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Resources/Data/x64/x86/fpm_scoreboard.h
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
Resources/Data/x64/x86/frontcontroller16.phpt
Resource
win7-20241023-en
Behavioral task
behavioral26
Sample
Resources/Data/x64/x86/frontcontroller16.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Resources/Data/x64/x86/gh12908.phpt
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Resources/Data/x64/x86/gh12908.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Resources/Data/x64/x86/gh13991.phpt
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Resources/Data/x64/x86/gh13991.phpt
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Resources/Data/x64/x86/htwj
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
Resources/Data/x64/x86/htwj
Resource
win10v2004-20241007-en
General
-
Target
Resources/Data/x64/schema041.phpt
-
Size
1KB
-
MD5
5f51b9a1581bb2f88ae0600b136b25df
-
SHA1
248d71b7eec2d96849750c2a624a61cbfa69e046
-
SHA256
cf261ac81f1aeff1f9a4cb5f729f842cbe558643b87082e1d9cdd6d72bf5bf47
-
SHA512
55cc81f3d20301bed713cd07b37aebaf29d715ced332a310c0d3d154b3501af7515e4c3c0497e0d666fd339256f48aa5f2d6e376f2a9b1eee433a1c869d18b62
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2748 OpenWith.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request60.153.16.2.in-addr.arpaIN PTRResponse60.153.16.2.in-addr.arpaIN PTRa2-16-153-60deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request166.190.18.2.in-addr.arpaIN PTRResponse166.190.18.2.in-addr.arpaIN PTRa2-18-190-166deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request180.129.81.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
60.153.16.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
14.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
196.249.167.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
166.190.18.2.in-addr.arpa
-
72 B 147 B 1 1
DNS Request
180.129.81.91.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa