Overview

overview

10

Static

static

10

14ed02af2b...e1.exe

windows7-x64

3

14ed02af2b...e1.exe

windows10-2004-x64

166bcfa4ec...88.exe

windows7-x64

7

166bcfa4ec...88.exe

windows10-2004-x64

7

18f6e53cc2...bc.exe

windows7-x64

3

18f6e53cc2...bc.exe

windows10-2004-x64

3

1ecdd2baa0...97.exe

windows7-x64

7

1ecdd2baa0...97.exe

windows10-2004-x64

7

259af5147b...f4.exe

windows7-x64

10

259af5147b...f4.exe

windows10-2004-x64

10

4c8b1c9ed7...16.exe

windows7-x64

3

4c8b1c9ed7...16.exe

windows10-2004-x64

3

4cca8b360d...0a.exe

windows7-x64

3

4cca8b360d...0a.exe

windows10-2004-x64

10

57f8e4e1d3...c5.exe

windows7-x64

9

57f8e4e1d3...c5.exe

windows10-2004-x64

9

922cba3477...c3.exe

windows7-x64

3

922cba3477...c3.exe

windows10-2004-x64

3

b5bd106864...88.exe

windows7-x64

10

b5bd106864...88.exe

windows10-2004-x64

10

da5f0322d3...24.exe

windows7-x64

7

da5f0322d3...24.exe

windows10-2004-x64

8

ec7b605aae...33.exe

windows7-x64

7

ec7b605aae...33.exe

windows10-2004-x64

9

ff70347ce0...0c.exe

windows7-x64

1

ff70347ce0...0c.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    61s
  • max time network
    65s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-01-2025 08:45

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    14ed02af2bfe80834dd59bd49650f5c982da1a9bf2a437450ce113eb6fcf9ee1.exe

  • Size

    7KB

  • MD5

    4262c56e7745e6a4203c77550586571f

  • SHA1

    98df4673cd065861e7b52dca9d55f836abd10872

  • SHA256

    14ed02af2bfe80834dd59bd49650f5c982da1a9bf2a437450ce113eb6fcf9ee1

  • SHA512

    1fa4772eb617fd3a44b53f308c939eee181c262c9619b91f1cb25913d906a426b94bd8c66cb83508dab31836fc8d410db184444b44da4d5e65dd88b29347a4b6

  • SSDEEP

    192:Aemtzvx1X/L3YLSB5p26kL3LKLQKpJZsfjr9pT:AjZLX/LoLOp26kL3LKLQKHefjr9p

Score
8/10
discoverypersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14ed02af2bfe80834dd59bd49650f5c982da1a9bf2a437450ce113eb6fcf9ee1.exe
    "C:\Users\Admin\AppData\Local\Temp\14ed02af2bfe80834dd59bd49650f5c982da1a9bf2a437450ce113eb6fcf9ee1.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4468
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4192
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2728
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1528
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3156
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4468-0-0x000000007531E000-0x000000007531F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4468-1-0x0000000000890000-0x0000000000898000-memory.dmp

    Filesize

    32KB

    Download

  • memory/4468-2-0x00000000058B0000-0x0000000005E54000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4468-3-0x0000000005300000-0x0000000005392000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4468-4-0x0000000005290000-0x000000000529A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4468-5-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4468-6-0x0000000075310000-0x0000000075AC0000-memory.dmp

    Filesize

    7.7MB

    Download