Overview
overview
10Static
static
1006038ed735...40.exe
windows10-ltsc 2021-x64
80673936fc0...9b.exe
windows10-ltsc 2021-x64
07b3c7c475...83.exe
windows10-ltsc 2021-x64
3097910dc61...d0.exe
windows10-ltsc 2021-x64
100bb3e9c660...40.exe
windows10-ltsc 2021-x64
100c80a0ef43...97.exe
windows10-ltsc 2021-x64
100cae214424...81.exe
windows10-ltsc 2021-x64
10b76a68b1da...15f.gz
windows10-ltsc 2021-x64
1bb7ad76bef...830.xz
windows10-ltsc 2021-x64
3cdb1365059...fbc.gz
windows10-ltsc 2021-x64
1Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250217-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12/03/2025, 14:18
Static task
static1
miraiupxaspackv2macromacro_on_actionratmybot1359593325miraigafgytgh0stratmrblackurelasxorddosredosdruagentteslananocoreneconyddcratponysakulanjratcobaltstrike
29 signatures
Behavioral task
behavioral1
Sample
06038ed7357e8d00e0fcef11800dfb40.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0673936fc0472890d129258bc6ce1f9b.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
07b3c7c475a0204f34408d806a4d0883.exe
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
097910dc615bd581069c0ec67fa513d0.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
0bb3e9c660f99967ca4c8e21bc46e940.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
0c80a0ef434aaecd6b1c888567935b97.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
10 signatures
150 seconds
Behavioral task
behavioral7
Sample
0cae2144249cca11917ce26657fc0281.exe
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral8
Sample
b76a68b1da993f63c3363dc43739315f.gz
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
bb7ad76bef5c5a974ccd0c1b94835830.xz
Resource
win10ltsc2021-20250218-en
windows10-ltsc 2021-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
cdb1365059c0e4973843dc0d0955bfbc.gz
Resource
win10ltsc2021-20250217-en
windows10-ltsc 2021-x64
2 signatures
150 seconds
General
-
Target
06038ed7357e8d00e0fcef11800dfb40.exe
-
Size
1.8MB
-
MD5
06038ed7357e8d00e0fcef11800dfb40
-
SHA1
4b885a0e2fa5b59338622ef7f2859c232d7ab7c6
-
SHA256
d85c8bbec339bdefe5e4c4409816554173974ffccd31272d5fcf138d022122d2
-
SHA512
6200aa51102d71eca42ecebd04253ce915244ef86a8409d6a3e86c9402e7081f3b4bebdfa9718543df3d332b17e6ec758d9556c533493d945905656108c72cbc
-
SSDEEP
49152:QIRg5x6slKZZPCPXNYJLfUWoU/OoGbnQ/7WUT9DMQloU/8:He5x6slKZTolo1loN
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\windows\SysWOW64\drivers\spo0lve.exe 06038ed7357e8d00e0fcef11800dfb40.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spron = "C:\\Users\\Admin\\AppData\\Local\\Temp/06038ed7357e8d00e0fcef11800dfb40.exe" 06038ed7357e8d00e0fcef11800dfb40.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pigdesk.bmp" 06038ed7357e8d00e0fcef11800dfb40.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseTVM.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Internet Explorer\iexplore.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Media Player\wmlaunch.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Mail\wabmig.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Internet Explorer\ielowutil.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\SenseCE.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseCM.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 06038ed7357e8d00e0fcef11800dfb40.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 06038ed7357e8d00e0fcef11800dfb40.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 06038ed7357e8d00e0fcef11800dfb40.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06038ed7357e8d00e0fcef11800dfb40.exe -
Modifies Control Panel 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\Desktop\WallpaperStyle = "2" 06038ed7357e8d00e0fcef11800dfb40.exe Set value (str) \REGISTRY\USER\S-1-5-21-1639757381-2759246526-4253643256-1000\Control Panel\Desktop\TileWallpaper = "2" 06038ed7357e8d00e0fcef11800dfb40.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2520 06038ed7357e8d00e0fcef11800dfb40.exe 2520 06038ed7357e8d00e0fcef11800dfb40.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06038ed7357e8d00e0fcef11800dfb40.exe"C:\Users\Admin\AppData\Local\Temp\06038ed7357e8d00e0fcef11800dfb40.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD5104aabb13d61756cd4176f8c44b91a61
SHA14652ed2f141a3ad5ac3fa2efbb908f90d8bea4c0
SHA256032617122a9afb47b75cf24a7fa768b84700f67370d3d6f495559c40855ee853
SHA512743f424590c6c08d423980b304f645b9bb04bc745f8aaad18b9b442334bfb005ccdc4c50e51eaa4a3c917ed83b13e8918c079bc7c6d55bb27b1c0be54b62ec57