Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3idle_maste....5.zip
windows7-x64
7idle_maste....5.zip
windows10-2004-x64
1idle_maste...ck.dll
windows7-x64
1idle_maste...ck.dll
windows10-2004-x64
1idle_maste...er.exe
windows7-x64
3idle_maste...er.exe
windows10-2004-x64
3idle_maste...xe.xml
windows7-x64
3idle_maste...xe.xml
windows10-2004-x64
1idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3idle_maste...es.dll
windows7-x64
3idle_maste...es.dll
windows10-2004-x64
3Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/01/2025, 13:50
Static task
static1
Behavioral task
behavioral1
Sample
idle_master_extended_v1.5.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
idle_master_extended_v1.5.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
idle_master_extended_v1.5/HtmlAgilityPack.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
idle_master_extended_v1.5/HtmlAgilityPack.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
idle_master_extended_v1.5/IdleMaster.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
idle_master_extended_v1.5/IdleMaster.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
idle_master_extended_v1.5/IdleMaster.exe.xml
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
idle_master_extended_v1.5/IdleMaster.exe.xml
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
idle_master_extended_v1.5/Languages/cs/IdleMaster.resources.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
idle_master_extended_v1.5/Languages/cs/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
idle_master_extended_v1.5/Languages/de/IdleMaster.resources.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
idle_master_extended_v1.5/Languages/de/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
idle_master_extended_v1.5/Languages/el/IdleMaster.resources.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
idle_master_extended_v1.5/Languages/el/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
idle_master_extended_v1.5/Languages/es/IdleMaster.resources.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
idle_master_extended_v1.5/Languages/es/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
idle_master_extended_v1.5/Languages/fi/IdleMaster.resources.dll
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
idle_master_extended_v1.5/Languages/fi/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
idle_master_extended_v1.5/Languages/fr/IdleMaster.resources.dll
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
idle_master_extended_v1.5/Languages/fr/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
idle_master_extended_v1.5/Languages/hu/IdleMaster.resources.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
idle_master_extended_v1.5/Languages/hu/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
idle_master_extended_v1.5/Languages/it/IdleMaster.resources.dll
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
idle_master_extended_v1.5/Languages/it/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
idle_master_extended_v1.5/Languages/ja/IdleMaster.resources.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
idle_master_extended_v1.5/Languages/ja/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
idle_master_extended_v1.5/Languages/ko/IdleMaster.resources.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
idle_master_extended_v1.5/Languages/ko/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
idle_master_extended_v1.5/Languages/nl/IdleMaster.resources.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
idle_master_extended_v1.5/Languages/nl/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
idle_master_extended_v1.5/Languages/no/IdleMaster.resources.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
idle_master_extended_v1.5/Languages/no/IdleMaster.resources.dll
Resource
win10v2004-20241007-en
General
-
Target
idle_master_extended_v1.5.zip
-
Size
1.3MB
-
MD5
27cd6ff4cc23d22d5352023def285ce3
-
SHA1
4d70059d333d7ceed8f9fbaff2b12c9761d40bb6
-
SHA256
a9b434b8acdad1d2cf583c8e0c4e1218ee1d7eb46a7925cafab9edd01b62dddf
-
SHA512
e09cf38c87697dd5d794d14d6b45de302c249e7b7dac5159b43fbc04c7b8fa1511af2aead9542b1fb7d69b3baff339d8725e109202aa16dc79d233180e379658
-
SSDEEP
24576:7Pds/dz2DS5PUKKTaMupDPIJPS//PYmuYXzSvDs9Aiy3ySqiaOD:70dJ6KLxp7kS/33pXzoI99CJki
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 912 IdleMaster.exe 2400 IdleMaster.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IdleMaster.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IdleMaster.exe -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\IdleMaster.exe = "10001" IdleMaster.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\IdleMaster.exe = "10001" IdleMaster.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IdleMaster.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IdleMaster.exe Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IdleMaster.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION IdleMaster.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main IdleMaster.exe Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl IdleMaster.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a IdleMaster.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 IdleMaster.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e IdleMaster.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 IdleMaster.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a IdleMaster.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1580 7zFM.exe 1580 7zFM.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1580 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeRestorePrivilege 1580 7zFM.exe Token: 35 1580 7zFM.exe Token: SeSecurityPrivilege 1580 7zFM.exe Token: 33 960 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 960 AUDIODG.EXE Token: 33 960 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 960 AUDIODG.EXE Token: SeSecurityPrivilege 1580 7zFM.exe Token: SeDebugPrivilege 912 IdleMaster.exe Token: SeSecurityPrivilege 1580 7zFM.exe Token: SeDebugPrivilege 2400 IdleMaster.exe Token: 33 2400 IdleMaster.exe Token: SeIncBasePriorityPrivilege 2400 IdleMaster.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1580 7zFM.exe 1580 7zFM.exe 1580 7zFM.exe 1580 7zFM.exe 1580 7zFM.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2400 IdleMaster.exe 2400 IdleMaster.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1580 wrote to memory of 912 1580 7zFM.exe 34 PID 1580 wrote to memory of 912 1580 7zFM.exe 34 PID 1580 wrote to memory of 912 1580 7zFM.exe 34 PID 1580 wrote to memory of 912 1580 7zFM.exe 34 PID 1580 wrote to memory of 2400 1580 7zFM.exe 35 PID 1580 wrote to memory of 2400 1580 7zFM.exe 35 PID 1580 wrote to memory of 2400 1580 7zFM.exe 35 PID 1580 wrote to memory of 2400 1580 7zFM.exe 35
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\idle_master_extended_v1.5.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\IdleMaster.exe"C:\Users\Admin\AppData\Local\Temp\7zOC260ABA8\IdleMaster.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC26A1EB8\IdleMaster.exe"C:\Users\Admin\AppData\Local\Temp\7zOC26A1EB8\IdleMaster.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2400
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2264
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4e81⤵
- Suspicious use of AdjustPrivilegeToken
PID:960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
734B
MD5e192462f281446b5d1500d474fbacc4b
SHA15ed0044ac937193b78f9878ad7bac5c9ff7534ff
SHA256f1ba9f1b63c447682ebf9de956d0da2a027b1b779abef9522d347d3479139a60
SHA512cc69a761a4e8e1d4bf6585aa8e3e5a7dfed610f540a6d43a288ebb35b16e669874ed5d2b06756ee4f30854f6465c84ee423502fc5b67ee9e7758a2dab41b31d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
Filesize192B
MD5fb15d233c3f1c24a5ca19d3444eb5508
SHA12ff62d953cc3e5ef2dd203db4c1b79cdf8c9fcdb
SHA25695eb4e74cd83b5988fc00a621087142ab69d8fbd5b83be9d49ad322e1e234f0e
SHA5126fbf1f3f107ed704d557171d7c828ec12b7f2df02628fdc8852a8b629e7d259a7f22e28015811f8a590086d1d8e1e052237fad6e73ba580bcbdbfc96e704fc51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a931ff0eee4aa729ff84c863a2922f51
SHA10217bfca2d4c123d38466189239f76480d2efa59
SHA2564762ff7a920ff68daf4358969b836f10bec29e798e4db88399d8f3b228f3cd09
SHA5125a51691fe466c196aa68fa00f1a36cf1726bf93cc1883ab56db462cc155ccc872e63f7b1694bbf4d409fb1f97db648f234c2168bacff480ac42feeb7ccdcb0bc
-
C:\Users\Admin\AppData\Local\IdleMaster\IdleMaster.exe_Url_rl44rujb2jo05zekpbiugk2oe5i0unp5\1.5.0.0\user.config
Filesize1KB
MD5c1fcee14ee892edbead0e34b89287086
SHA133511076145303373cca2e983f1199e622303392
SHA256e015b81df1553c54842f253493e66521282b91cb56d9a7ed5c2bb18bb58869a3
SHA512e1d4c8be69cf8b02d4a00ae4a441e462c7c4f3c9138a79644e554595ee81df256023e1ca1ec23c605b9e10b7f5f283468ecebc2984ed6148c17fa4533c54e2a9
-
C:\Users\Admin\AppData\Local\IdleMaster\IdleMaster.exe_Url_rl44rujb2jo05zekpbiugk2oe5i0unp5\1.5.0.0\user.config
Filesize815B
MD5a3a9f5b2703f21c20569249015d94e78
SHA11c6e9b292a2e19b4f08a3eda556efef17d7f959e
SHA256343170b3dc30f6369c4ed04ec37d37bd8b62a02d02b86011057abc64851644c7
SHA512024c5cbbe1a3954f04d6103de0c549ab43aca02f135e9be71696a707d141b9af2ab04dbcd023e3b4d1fc18d1d0af9ffdac28323ee2e6c933e3a010cd9def57b5
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\home[1].htm
Filesize47KB
MD55b14e9ccd0e4d51d6cded71bdfb141ce
SHA1d3ee87494c749830abf0c916a021d54fc5e3edbb
SHA2568e57c9c0b7e2428bfaa9e5261f8b00d6130f7b6f72b528958799717851158706
SHA512af7e81db6bdaf971c68a412cc5b654ed73aef2a3452c67be221ecf72f8f04d7418526bdba61ddfdb66ddcfcb3515de15ad737fac661b5de5816aa76442936a63
-
Filesize
1.8MB
MD5b2ea62fe861c412083bf6698409b9cfd
SHA19187ed38aec00f0ac3293a0c0705f88b1f656d66
SHA25639e35d356449abcfa18b20855dc6e65b37905b3c737e913ba8b0abbad4a8ff2a
SHA51208bc26db1c2db8f5861d9b3baaa52455812634398c184bebc5c176d11c6efae46e6a4139254544cbfaf10f1bf0ba1ae2204973fd64807c5299ec77353eb93477
-
Filesize
8KB
MD51b52318d6c81b386fc60efa4d0f280c7
SHA18b73a6cfd8af64e2782a6b0f3508ec107436bc73
SHA256d3eeacdd59846b7b5151b788a47a1896ef098fac7c44110402e8947479651f19
SHA5126ea6a83365a19c2041b74ccc2e12e3ded6b018b2c25421d672f672a6c14f2e549697d2c05b3c83f2a925a32594425957e2f03022fcc7fcc715dc732436dd485a
-
Filesize
8KB
MD592d99d5e13e1e5c7389b6f9c12ff06fa
SHA1cff45c09e14d5cf760f375f170bc77205364de30
SHA256099e4beffca7faaed5be16ab7f3d26daa4ebbbc2c8f4059b6f43c0e111eb2e1e
SHA5126320415cfea897c5a9e9b7a616c38d6abe51ecf6fa6e4d78069f5d8cb3eb6090d8e522da440fec1d80bc258de5c40d15b2987c437885c4552703eb7de502259a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b