Overview
overview
10Static
static
10Malware-1-master.zip
windows7-x64
1Malware-1-...30.exe
windows7-x64
10Malware-1-...40.exe
windows7-x64
10Malware-1-...32.exe
windows7-x64
10Malware-1-.../5.exe
windows7-x64
10Malware-1-...91.exe
windows7-x64
10Malware-1-...ey.exe
windows7-x64
7Malware-1-....0.zip
windows7-x64
1Malware-1-...ad.exe
windows7-x64
3Malware-1-...ti.exe
windows7-x64
5Malware-1-...an.bat
windows7-x64
7Malware-1-...an.exe
windows7-x64
3Malware-1-...ve.bat
windows7-x64
7Malware-1-...ve.exe
windows7-x64
6Malware-1-...ya.exe
windows7-x64
6Malware-1-...re.exe
windows7-x64
10Malware-1-...ry.exe
windows7-x64
10Malware-1-...ck.exe
windows7-x64
3Malware-1-...he.exe
windows7-x64
10Malware-1-...op.exe
windows7-x64
7Malware-1-...rb.exe
windows7-x64
10Malware-1-...ue.exe
windows7-x64
1Malware-1-...ng.exe
windows7-x64
6Malware-1-...kt.bat
windows7-x64
7Malware-1-...o3.exe
windows7-x64
10Malware-1-...ey.exe
windows7-x64
10Malware-1-.../m.exe
windows7-x64
Malware-1-...o3.exe
windows7-x64
9Malware-1-...dme.md
windows7-x64
3Malware-1-...er.zip
windows7-x64
1Malware-1-...ic.exe
windows7-x64
3Malware-1-...in.exe
windows7-x64
10Resubmissions
17-01-2025 20:14
250117-yz7h3s1qfw 1017-01-2025 20:12
250117-yy9l2sslcr 1017-01-2025 17:25
250117-vy9p9sxpez 1017-01-2025 17:21
250117-vw8eesyjfp 1017-01-2025 14:16
250117-rk9ass1rhk 1017-01-2025 14:12
250117-rhv1ds1lds 1016-01-2025 12:52
250116-p4et7a1mez 1016-01-2025 12:50
250116-p29xjssjep 1016-01-2025 12:49
250116-p2cbaasjam 1013-01-2025 04:35
250113-e7x5tswlfz 10Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-01-2025 15:53
Behavioral task
behavioral1
Sample
Malware-1-master.zip
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Malware-1-master/2530.exe
Resource
win7-20240903-en
Behavioral task
behavioral3
Sample
Malware-1-master/2887140.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Malware-1-master/32.exe
Resource
win7-20240903-en
Behavioral task
behavioral5
Sample
Malware-1-master/5.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Malware-1-master/96591.exe
Resource
win7-20240729-en
Behavioral task
behavioral7
Sample
Malware-1-master/Amadey.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Malware-1-master/Blocked-v1.0.zip
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
Malware-1-master/Download.exe
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Malware-1-master/Illuminati.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win7-20240903-en
Behavioral task
behavioral13
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win7-20240729-en
Behavioral task
behavioral15
Sample
Malware-1-master/Petya.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Malware-1-master/Software.exe
Resource
win7-20241023-en
Behavioral task
behavioral17
Sample
Malware-1-master/WannaCry.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
Malware-1-master/apache.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Malware-1-master/butterflyondesktop.exe
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
Malware-1-master/crb.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Malware-1-master/eternalblue.exe
Resource
win7-20241023-en
Behavioral task
behavioral23
Sample
Malware-1-master/fear.png.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
Malware-1-master/getr3kt.bat
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
Malware-1-master/iimo3.exe
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
Malware-1-master/jey.exe
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
Malware-1-master/m.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Malware-1-master/mo3.exe
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
Malware-1-master/readme.md
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
Malware-1-master/wannakey-master.zip
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
Malware-1-master/wintonic.exe
Resource
win7-20240903-en
General
-
Target
Malware-1-master/5.exe
-
Size
312KB
-
MD5
0b0dc2b2ccd4b46b3381508f7209a582
-
SHA1
a67a1619f96914e4e50e4f86f656ebb54021879a
-
SHA256
66ae33003289d8c6c3dc7c45c1b01110b4820281061292ac076b1783700a1f2d
-
SHA512
0715c2f6e01a923deb8bd5c4c70906942ee46dba6383bbd2edbde53e23a7b5c2ab8063e5f48a973925815f1dec18fe15c362fcf928d4f35d12dcf123f303cc37
-
SSDEEP
3072:5ODQa/lz20bbn7yXO/7/rCaZXo3ZU+BfhYJMyTPkDDYvU:+Qahr7DZXSpnSs
Malware Config
Signatures
-
Emotet family
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat shimsmonjpn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shimsmonjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shimsmonjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shimsmonjpn.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings shimsmonjpn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" shimsmonjpn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shimsmonjpn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA}\WpadDecisionTime = 209114700a65db01 shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections shimsmonjpn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shimsmonjpn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-6d-cb-62-52-1e\WpadDecision = "0" shimsmonjpn.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA}\WpadNetworkName = "Network 3" shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA}\ea-6d-cb-62-52-1e shimsmonjpn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-6d-cb-62-52-1e\WpadDecisionTime = 209114700a65db01 shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA} shimsmonjpn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA}\WpadDecisionReason = "1" shimsmonjpn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7DDC1D61-B2DE-4DE7-BB97-5D09A6B0DBEA}\WpadDecision = "0" shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-6d-cb-62-52-1e shimsmonjpn.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-6d-cb-62-52-1e\WpadDecisionReason = "1" shimsmonjpn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings shimsmonjpn.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0188000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 shimsmonjpn.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2184 5.exe 2380 5.exe 2240 shimsmonjpn.exe 2780 shimsmonjpn.exe 984 shimsmonjpn.exe 984 shimsmonjpn.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2380 5.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2380 2184 5.exe 31 PID 2184 wrote to memory of 2380 2184 5.exe 31 PID 2184 wrote to memory of 2380 2184 5.exe 31 PID 2184 wrote to memory of 2380 2184 5.exe 31 PID 2240 wrote to memory of 2780 2240 shimsmonjpn.exe 33 PID 2240 wrote to memory of 2780 2240 shimsmonjpn.exe 33 PID 2240 wrote to memory of 2780 2240 shimsmonjpn.exe 33 PID 2240 wrote to memory of 2780 2240 shimsmonjpn.exe 33 PID 2780 wrote to memory of 984 2780 shimsmonjpn.exe 34 PID 2780 wrote to memory of 984 2780 shimsmonjpn.exe 34 PID 2780 wrote to memory of 984 2780 shimsmonjpn.exe 34 PID 2780 wrote to memory of 984 2780 shimsmonjpn.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2380
-
-
C:\Windows\SysWOW64\shimsmonjpn.exe"C:\Windows\SysWOW64\shimsmonjpn.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\shimsmonjpn.exe"C:\Windows\SysWOW64\shimsmonjpn.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\shimsmonjpn.exe"C:\Windows\SysWOW64\shimsmonjpn.exe"3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:984
-
-