Analysis
-
max time kernel
240s -
max time network
261s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 01:07
Behavioral task
behavioral1
Sample
IDA-Pro-7.7-main/ida64.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
900 seconds
Behavioral task
behavioral2
Sample
IDA-Pro-7.7-main/ida64.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
900 seconds
General
-
Target
IDA-Pro-7.7-main/ida64.exe
-
Size
4.0MB
-
MD5
24ba0b4e0a3445a6c2fb866d94669f05
-
SHA1
3b6bf89f5ec4b19266260fd488ae720a90f1865d
-
SHA256
70840575ebddb25412f6de60329d5d395b325b709df9202411b723d0744c9624
-
SHA512
dcbd7babaa0de562a0a6682c3c0b053c419ddc2e78d6a0213c081a5ca50a256a720d0c6cbf3b2de669a5410918dfeb2d7d4fc29b23ae3285103c8e3c2be8b2b0
-
SSDEEP
49152:GQptxtn8v9flRURQXyczsoBR9RAzkdk9ltnv2UtxOpYjObpJWYcmD75zoELxnXAm:GitxMR4QuoBPRAzz9lRvMVtdwdZro6m
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\NodeSlot = "4" ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4 ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0 = 6a003100000000002a5aea1010204944412d50527e312e372d4d00004e0008000400efbe2a5ae8102a5aea102a0000009a7301000000070000000000000000000000000000004900440041002d00500072006f002d0037002e0037002d006d00610069006e0000001c000000 ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 4c003100000000002359e72a10204c6f63616c00380008000400efbe2359ab292359e72a2a000000000200000000020000000000000000000000000000004c006f00630061006c00000014000000 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\0\MRUListEx = ffffffff ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1" ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 4a003100000000002a5ae810102054656d700000360008000400efbe2359ab292a5ae8102a00000001020000000002000000000000000000000000000000540065006d007000000014000000 ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags ida64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Generic" ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257" ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = 00000000ffffffff ida64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 7e0074001c004346534616003100000000002359ab29122041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe2359ab292359ab292a000000ed0100000000020000000000000000000000000000004100700070004400610074006100000042000000 ida64.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" ida64.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" ida64.exe Set value (data) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202 ida64.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" ida64.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2796 ida64.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2796 ida64.exe 2100 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2796 ida64.exe Token: SeShutdownPrivilege 2796 ida64.exe Token: SeDebugPrivilege 2100 taskmgr.exe -
Suspicious use of FindShellTrayWindow 36 IoCs
pid Process 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe -
Suspicious use of SendNotifyMessage 33 IoCs
pid Process 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe 2100 taskmgr.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe 2796 ida64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\ida64.exe"C:\Users\Admin\AppData\Local\Temp\IDA-Pro-7.7-main\ida64.exe"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2796
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5404220e28dc0873e753bd230e316dbfe
SHA176e5b250c1e4949a330b5c843e35fd87c1cb8c1b
SHA256cfe656a0c8f075b74f5d186e7b619f0434768140fd7086e162ab2f46331532e1
SHA512165377d53c27a457562d593b897f20733dbe27a1392c45d95e9168bc01783035fd35737f6b1a8fb3b249c545225f2cb011dc6c92ef6259e41243e791adc808d6