Analysis
- max time kernel
94s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/01/2025, 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe
- Size 5.2MB
- Sample250112-wde6lavmap
- SHA256 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb
- MD5 54e383ca658ebd3caaf586f032f1c401
- SHA1 bc013aace5491c65a869e944123a4344cea6c1f0
- SHA512 4d10c2f888b5f56b59341e1dee5c53f56f2d81a9034eda36182bfd04246274d1fdee85b3ceccd5677ae8608626c2952ddd30fbe730dac54e405983c2a35fe51c
- SSDEEP 49152:UTyQOnGEoOozdSv3U4Yn0+U0vN52S7aoRPWicuRX3EYqDqmjVNiIhnU/hHYBWZh0:KSv31WaZlah4q1W61nH/a
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "\\\\?\\C:\\Users\\Admin\\AppData\\Local\\Temp\\downloaded_wallpaper.jpg" b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7-zip.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\History.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l1-2-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\License.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-processthreads-l1-1-1.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt.Lock b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe - Runs net.exe
- Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4488 4932 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe 83 PID 4932 wrote to memory of 4488 4932 b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe 83 PID 4488 wrote to memory of 1840 4488 net.exe 84 PID 4488 wrote to memory of 1840 4488 net.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe"C:\Users\Admin\AppData\Local\Temp\b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb.exe"1⤵
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\system32\net.exe"net" session2⤵
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session3⤵PID:1840
-
-