Overview

overview

10

Static

static

10

beed61dc63...0235e9

windows7-x64

beed61dc63...0235e9

windows10-2004-x64

8

Resubmissions

20-02-2025 10:50

250220-mw8festjaz 10

16-02-2025 02:33

250216-c1244ayjc1 10

16-02-2025 02:26

250216-cw6xgsxldq 10

12-02-2025 14:54

250212-r9zgwswmej 10

12-02-2025 14:27

250212-rsdtvsvqet 10

12-02-2025 14:17

250212-rl7hlavngy 10

12-02-2025 13:47

250212-q3q2hatqes 10

12-02-2025 13:43

250212-q1d9xstlap 10

11-02-2025 01:03

250211-behmwstpdv 10

Analysis

  • max time kernel
    222s
  • max time network
    223s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-02-2025 02:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9

  • Size

    8.5MB

  • MD5

    2d690d32e637c43a18aa8f4f2fd28e48

  • SHA1

    f8a5f75a34d2751c0e7195cd4adabddc1ece465e

  • SHA256

    beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9

  • SHA512

    2641192c4ebb0a66fdf6a9be16ccfc38a4cd98a32467d5b6e719c73b2893a28888b7c9c77d3db3a0d2e93d14408081bdc92238dc3a5b1479229843f354c7305e

  • SSDEEP

    196608:exCyu9hdCjcHsm2gTEE/OBBZVaMKb0QqNnJi6lWzVYK5P6qwpxFlWavvy7:ervy

Score
8/10
discovery

Malware Config

Signatures

  • Downloads MZ/PE file 2 IoCs
  • Drops file in System32 directory 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\beed61dc63e3b01b93e6c50c6885b89988b59a3f6abdfa24e922e1402a0235e9
    1⤵
      PID:628
    • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QTExMDU0NTItNjIxMi00MTBELUE2M0YtRDkxNTI5MkZFRDFBfSIgdXNlcmlkPSJ7QUVFQUZFQzgtM0VFRS00NDZCLTgxODYtQjUyMzU1NEFFMzlCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NTBEQ0ZEMDQtNzJFQy00RENELUFERDktOEJBNUQ3RjBBQjEyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI4IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU5MjEiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODE5ODA3NzAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDIxNDIwNjYwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
      1⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      PID:4940
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\SendAssert.jpg" /ForceBootstrapPaint3D
      1⤵
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1632
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
      1⤵
      • Drops file in System32 directory
      PID:2824
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4120
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x4 /state0:0xa3862055 /state1:0x41c64e6d
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:4908

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2824-5-0x000002B6BE360000-0x000002B6BE370000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2824-1-0x000002B6BD990000-0x000002B6BD9A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2824-12-0x000002B6C6620000-0x000002B6C6621000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-14-0x000002B6C66A0000-0x000002B6C66A1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-16-0x000002B6C66A0000-0x000002B6C66A1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-17-0x000002B6C6730000-0x000002B6C6731000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-18-0x000002B6C6730000-0x000002B6C6731000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-19-0x000002B6C6740000-0x000002B6C6741000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2824-20-0x000002B6C6740000-0x000002B6C6741000-memory.dmp

      Filesize

      4KB

      Download