Overview
overview
10Static
static
10Malware-1-...30.exe
windows7-x64
10Malware-1-...30.exe
windows10-2004-x64
10Malware-1-...40.exe
windows7-x64
10Malware-1-...40.exe
windows10-2004-x64
10Malware-1-...32.exe
windows7-x64
10Malware-1-...32.exe
windows10-2004-x64
10Malware-1-.../5.exe
windows7-x64
10Malware-1-.../5.exe
windows10-2004-x64
10Malware-1-...91.exe
windows7-x64
10Malware-1-...91.exe
windows10-2004-x64
10Malware-1-...ey.exe
windows7-x64
7Malware-1-...ey.exe
windows10-2004-x64
7Malware-1-...ad.exe
windows7-x64
3Malware-1-...ad.exe
windows10-2004-x64
3Malware-1-...ti.exe
windows7-x64
5Malware-1-...ti.exe
windows10-2004-x64
5Malware-1-...an.bat
windows7-x64
7Malware-1-...an.bat
windows10-2004-x64
7Malware-1-...an.exe
windows7-x64
3Malware-1-...an.exe
windows10-2004-x64
7Malware-1-...ve.bat
windows7-x64
7Malware-1-...ve.bat
windows10-2004-x64
7Malware-1-...ve.exe
windows7-x64
6Malware-1-...ve.exe
windows10-2004-x64
7Malware-1-...ya.exe
windows7-x64
6Malware-1-...ya.exe
windows10-2004-x64
Malware-1-...re.exe
windows7-x64
10Malware-1-...re.exe
windows10-2004-x64
10Malware-1-...ry.exe
windows7-x64
10Malware-1-...ry.exe
windows10-2004-x64
10Malware-1-...ck.exe
windows7-x64
3Malware-1-...ck.exe
windows10-2004-x64
3Resubmissions
17-01-2025 20:14
250117-yz7h3s1qfw 1017-01-2025 20:12
250117-yy9l2sslcr 1017-01-2025 17:25
250117-vy9p9sxpez 1017-01-2025 17:21
250117-vw8eesyjfp 1017-01-2025 14:16
250117-rk9ass1rhk 1017-01-2025 14:12
250117-rhv1ds1lds 1016-01-2025 12:52
250116-p4et7a1mez 1016-01-2025 12:50
250116-p29xjssjep 1016-01-2025 12:49
250116-p2cbaasjam 1013-01-2025 04:35
250113-e7x5tswlfz 10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-01-2025 14:12
Behavioral task
behavioral1
Sample
Malware-1-master/2530.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
Malware-1-master/2530.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Malware-1-master/2887140.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
Malware-1-master/2887140.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Malware-1-master/32.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Malware-1-master/32.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Malware-1-master/5.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Malware-1-master/5.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Malware-1-master/96591.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Malware-1-master/96591.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Malware-1-master/Amadey.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
Malware-1-master/Amadey.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Malware-1-master/Download.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral14
Sample
Malware-1-master/Download.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Malware-1-master/Illuminati.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral16
Sample
Malware-1-master/Illuminati.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
Malware-1-master/MEMZ-Clean.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral20
Sample
Malware-1-master/MEMZ-Clean.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral22
Sample
Malware-1-master/MEMZ-Destructive.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
Malware-1-master/MEMZ-Destructive.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Malware-1-master/Petya.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral26
Sample
Malware-1-master/Petya.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Malware-1-master/Software.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral28
Sample
Malware-1-master/Software.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Malware-1-master/WannaCry.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral30
Sample
Malware-1-master/WannaCry.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
Malware-1-master/Win32.EvilClusterFuck.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Malware-1-master/5.exe
-
Size
312KB
-
MD5
0b0dc2b2ccd4b46b3381508f7209a582
-
SHA1
a67a1619f96914e4e50e4f86f656ebb54021879a
-
SHA256
66ae33003289d8c6c3dc7c45c1b01110b4820281061292ac076b1783700a1f2d
-
SHA512
0715c2f6e01a923deb8bd5c4c70906942ee46dba6383bbd2edbde53e23a7b5c2ab8063e5f48a973925815f1dec18fe15c362fcf928d4f35d12dcf123f303cc37
-
SSDEEP
3072:5ODQa/lz20bbn7yXO/7/rCaZXo3ZU+BfhYJMyTPkDDYvU:+Qahr7DZXSpnSs
Malware Config
Signatures
-
Emotet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifaceavi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifaceavi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifaceavi.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1688 5.exe 1688 5.exe 5032 5.exe 5032 5.exe 2072 ifaceavi.exe 2072 ifaceavi.exe 5084 ifaceavi.exe 5084 ifaceavi.exe 3260 ifaceavi.exe 3260 ifaceavi.exe 3260 ifaceavi.exe 3260 ifaceavi.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 3260 ifaceavi.exe 3260 ifaceavi.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 3260 ifaceavi.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 taskmgr.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 5032 5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2028 taskmgr.exe Token: SeSystemProfilePrivilege 2028 taskmgr.exe Token: SeCreateGlobalPrivilege 2028 taskmgr.exe -
Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe 2028 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1688 wrote to memory of 5032 1688 5.exe 88 PID 1688 wrote to memory of 5032 1688 5.exe 88 PID 1688 wrote to memory of 5032 1688 5.exe 88 PID 2072 wrote to memory of 5084 2072 ifaceavi.exe 92 PID 2072 wrote to memory of 5084 2072 ifaceavi.exe 92 PID 2072 wrote to memory of 5084 2072 ifaceavi.exe 92 PID 5084 wrote to memory of 3260 5084 ifaceavi.exe 93 PID 5084 wrote to memory of 3260 5084 ifaceavi.exe 93 PID 5084 wrote to memory of 3260 5084 ifaceavi.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\5.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:5032
-
-
C:\Windows\SysWOW64\ifaceavi.exe"C:\Windows\SysWOW64\ifaceavi.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\ifaceavi.exe"C:\Windows\SysWOW64\ifaceavi.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\ifaceavi.exe"C:\Windows\SysWOW64\ifaceavi.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2028
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2680