Overview

overview

7

Static

static

3

4cc14a2de3...e9.exe

windows7-x64

7

4cc14a2de3...e9.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    20-01-2025 09:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4cc14a2de3546d445364cd8b09293e4ec6b7b82aa6d4f2a3723984735550cbe9.exe

  • Size

    172KB

  • MD5

    95c2b21ac9aedd8823d450270c157414

  • SHA1

    0763082e03f8006e020796d0bdfc4c451bc6cc0c

  • SHA256

    4cc14a2de3546d445364cd8b09293e4ec6b7b82aa6d4f2a3723984735550cbe9

  • SHA512

    22e813e752174b2ec2a67b5b5b069d2434e9fcba3675a1fc36372e1d54e6ff599bad61ffad7d2b695c391c3faa302a1521e2ec406652803f208b1f6bba6d9506

  • SSDEEP

    3072:fJpOm5axh63laEo+pXX1pQD2UCohD8mxLCj+5cmeDye42L712xrpdJ8xLeb7UZ:hAm5oh63laEo+pXX1pkF8mxeq5+4m71V

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 14 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 62 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4cc14a2de3546d445364cd8b09293e4ec6b7b82aa6d4f2a3723984735550cbe9.exe
    "C:\Users\Admin\AppData\Local\Temp\4cc14a2de3546d445364cd8b09293e4ec6b7b82aa6d4f2a3723984735550cbe9.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\ProgramData\NTService\sppcomapi.exe
      "C:\ProgramData\NTService\sppcomapi.exe" 1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2668
      • C:\Users\Admin\AppData\Roaming\NTService\sppcomapi.exe
        "C:\Users\Admin\AppData\Roaming\NTService\sppcomapi.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:2332
    • C:\ProgramData\NTService\sppcomapi.exe
      "C:\ProgramData\NTService\sppcomapi.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Maps connected drives based on registry
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\ProgramData\NTService\sppcomapi.exe
        "C:\ProgramData\NTService\sppcomapi.exe" 1
        3⤵
        • Executes dropped EXE
        • Enumerates connected drives
        • Maps connected drives based on registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:792
  • C:\ProgramData\NTService\sppcomapi.exe
    C:\ProgramData\NTService\sppcomapi.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Enumerates connected drives
    • Maps connected drives based on registry
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\ProgramData\NTService0\sppcomapi.exe
      "C:\ProgramData\NTService0\sppcomapi.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Maps connected drives based on registry
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\NTService0\lielfeehdi.sys
    Filesize

    5KB

    MD5

    1ac6b4e611de4c9a89cefc7c0cdbcbf8

    SHA1

    193216685a6dd6e84758206f847cc9834ec3bb49

    SHA256

    b1bf1c017ee8612892c4b8f239235aedf76532ea714fe2a7d01054cf7ac7908c

    SHA512

    b1c6be05e553207f64a8ff0ed97cb32ddf7b53919418dbda0d1f158889f25523ee55f9e108f1b77604b2c526584e25c25d51486a8da7abd5e632b7177dbe48cc

    Download Submit

  • C:\ProgramData\NTService0\losiicpog\isecfeaqqe.dmp
    Filesize

    8KB

    MD5

    74854f248b8af74b67df6362085e7044

    SHA1

    94dab57a614827a7f24786e1fe1479cbb5eafd64

    SHA256

    65c7bf08696dcf71ffe76b99da40b344856d3b698af0b29f1e180ac0209e8274

    SHA512

    5f0db4c60f5c7e5995c784b22c6efdd5fd9b28d74ad135f6eaae321efd36f7c4568911d3770868d8cd6e3eff95d84af541cd1e4420662813829bd41c0e1c8a84

    Download Submit

  • C:\ProgramData\NTService0\losiicpog\upocelc.dat
    Filesize

    2KB

    MD5

    b5ae7a6e70041156b1e3faa41616ee63

    SHA1

    f84343bbb2764d9bdf55e976f5cd8c8340440ef9

    SHA256

    c099c65dba5ed3d6c41379071b07ee1d27f9c6ca73e6251aab0223ac070607f3

    SHA512

    fd354eb0db8ad68c348904f62313ad175a7e99d8536dde5df9e0c1b47cb0f66bf022e9d21332ab345ed0830d8e335e615b73483ad5e4b31ec5e588a1d148ec4b

    Download Submit

  • C:\ProgramData\NTService0\socec.dat
    Filesize

    4KB

    MD5

    9a45b3ef5fc1c274810717527c29698d

    SHA1

    ed9c68d6086e3e0a43c48d512cba46bb5fe8ab6c

    SHA256

    502107658f3d98f013738fa3b47bebb382b491e231927e96fb597a57355910d9

    SHA512

    1a4167bf92bccf5d729a8b0477cfca5762a10c75dc25673119e53c21e7424beefe5cbd11331dba50679f4d48ce5fc61404df17c004552bb0d4dc8d81ede072bd

    Download Submit

  • C:\ProgramData\NTService0\tasetoaxs\odd.sys
    Filesize

    1KB

    MD5

    f33e53c04d65be7bc40b80998ea32a06

    SHA1

    1a8002a12788e3d494ada737867076de21f5d0bd

    SHA256

    791ff95edac5d5e4432835a6559f8d97ddc65a0d7dfa63c13538964013c91711

    SHA512

    da05f689462633543a98ba0ecc8a341afc78b681c50e1152dd96b15a4ded2e8a967e8784d4092f58fd33755bb043afa77b2ec1e317b9933ecf9f8fba538d9017

    Download Submit

  • C:\ProgramData\NTService0\tasetoaxs\utwa.ocx
    Filesize

    4KB

    MD5

    e118eaa89a8741575e256f90c33ec7a1

    SHA1

    ed66a2165849f71a62a99c4ba287b8b7fd1bc207

    SHA256

    3ec90448be43f522c4af1352b1772bb578d368333f018f78fac012d6b4b5a09c

    SHA512

    70945a013536ed6f0985903ca1498501bc5ea1538330a9c86f1e4872555adc6a265294f5c65ff413a3edf1ab95147ea88158bb1cc376d56efd588f6107126693

    Download Submit

  • C:\ProgramData\NTService\sppcomapi.exe
    Filesize

    172KB

    MD5

    cb386fb8a2c0cbb4f6357c5bfc3d4445

    SHA1

    5b240a557881ac286cf7eb2f7654f3883dc6e998

    SHA256

    33181847c8213dc3718f615385e2a559442a1269b80da631f29e0363973109ed

    SHA512

    ce53f046eb36b1cbeea89ad9cd7ecafcd46efc23754738447c69de29331a65fa052f8452da6158aac2c9273286827720d162a17999eb3f65f0544a2330adc025

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O2HUNI7R.txt
    Filesize

    220B

    MD5

    ed0dad5bb84aa03aebea557981fbb78f

    SHA1

    d8e54392a0a38ce3f5dfcaf95d83b2216420457c

    SHA256

    596bf4d63bfabd91e0f159383dbd9c7cb1aaed21151d2e656d733b8c59c9437d

    SHA512

    a799c57f45ba00a9cda7c925dc105d49fd3c37dd6011b59111f73f451698b6647219e040eb473a89d62f90533e99d3ddd377b558ac23aba98d5e58d43545c0f5

    Download Submit

  • \Users\Admin\AppData\Roaming\NTService\sppcomapi.exe
    Filesize

    172KB

    MD5

    fcf0c0290e94d1a0137778bbd9fb41c4

    SHA1

    754b94bbea7dee153d2d7d88f7ade90e89a296d2

    SHA256

    e983f88796bc5b822110339d0d01ce89813110e495121aad7660bc01adf96ae1

    SHA512

    ef4bee5e2faac6efea607e4bc5ee4091bb0393b8b17ace5b33716d62fa9352f65563690f3cf765ea74262f17cc9edeabffe457b48bb8fa1829cfe009429b5088

    Download Submit