Analysis

  • max time kernel
    120s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18/03/2025, 14:55

General

  • Target

    Autoruns/Autoruns.exe

  • Size

    1.7MB

  • MD5

    17bd13edd536269c417ba8e1b4534fbe

  • SHA1

    22470bb3a4c37a0c612ff7ad2596306065ac0c9b

  • SHA256

    6111a70da65153e6ded71eae2057bf6760f340476261f6e15a80479daf9724eb

  • SHA512

    00d8c80dcfdda235d06160b40d06e47bd0be5178c5fb2b26bf4cd984eae520d877517a16d1a62d88ed1f0a46244eafd4cc4b4183a35f85d13b250e492d441455

  • SSDEEP

    12288:5nhZrVs162LpM5mzIhM6jl8/yX0Chz8rgRO6u2TdimrfZetCvmKT6IQViL/MW5b8:s0qQhMIX0e8uOR2xZnkiYWZk3

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Autoruns\Autoruns.exe
    "C:\Users\Admin\AppData\Local\Temp\Autoruns\Autoruns.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C3948BE6E525B8A8CEE9FAC91C9E392_F70553637B9F26717122C4DAFA3ADB11

    Filesize

    5B

    MD5

    5bfa51f3a417b98e7443eca90fc94703

    SHA1

    8c015d80b8a23f780bdd215dc842b0f5551f63bd

    SHA256

    bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

    SHA512

    4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

  • C:\Users\Admin\AppData\Local\Temp\Cab32D5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar33D6.tmp

    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

  • memory/2680-0-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2680-13-0x0000000003D90000-0x0000000003DCE000-memory.dmp

    Filesize

    248KB

  • memory/2680-70-0x0000000003DA0000-0x0000000003DF7000-memory.dmp

    Filesize

    348KB

  • memory/2680-69-0x0000000003DA0000-0x0000000003DF7000-memory.dmp

    Filesize

    348KB

  • memory/2680-72-0x0000000003DA0000-0x0000000003DAA000-memory.dmp

    Filesize

    40KB

  • memory/2680-71-0x0000000003DA0000-0x0000000003DAA000-memory.dmp

    Filesize

    40KB

  • memory/2680-74-0x0000000004970000-0x00000000049EB000-memory.dmp

    Filesize

    492KB

  • memory/2680-73-0x0000000004970000-0x00000000049EB000-memory.dmp

    Filesize

    492KB

  • memory/2680-75-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2680-76-0x0000000003DA0000-0x0000000003DF6000-memory.dmp

    Filesize

    344KB

  • memory/2680-90-0x0000000003D50000-0x0000000003D7F000-memory.dmp

    Filesize

    188KB

  • memory/2680-89-0x0000000003D50000-0x0000000003D7F000-memory.dmp

    Filesize

    188KB

  • memory/2680-88-0x0000000003DD0000-0x0000000003E0E000-memory.dmp

    Filesize

    248KB

  • memory/2680-87-0x0000000003D90000-0x0000000003DCE000-memory.dmp

    Filesize

    248KB

  • memory/2680-91-0x0000000003DA0000-0x0000000003DF7000-memory.dmp

    Filesize

    348KB

  • memory/2680-93-0x00000000040B0000-0x0000000004139000-memory.dmp

    Filesize

    548KB

  • memory/2680-92-0x00000000040B0000-0x0000000004139000-memory.dmp

    Filesize

    548KB

  • memory/2680-95-0x0000000003D50000-0x0000000003D62000-memory.dmp

    Filesize

    72KB

  • memory/2680-94-0x0000000003DA0000-0x0000000003DAA000-memory.dmp

    Filesize

    40KB

  • memory/2680-96-0x0000000003D50000-0x0000000003D62000-memory.dmp

    Filesize

    72KB

  • memory/2680-98-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-99-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-97-0x0000000004970000-0x00000000049EB000-memory.dmp

    Filesize

    492KB

  • memory/2680-101-0x0000000003D70000-0x0000000003D77000-memory.dmp

    Filesize

    28KB

  • memory/2680-100-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-131-0x0000000003D50000-0x0000000003D67000-memory.dmp

    Filesize

    92KB

  • memory/2680-130-0x0000000003D50000-0x0000000003D7F000-memory.dmp

    Filesize

    188KB

  • memory/2680-129-0x0000000003D50000-0x0000000003D7F000-memory.dmp

    Filesize

    188KB

  • memory/2680-133-0x0000000003D50000-0x0000000003D65000-memory.dmp

    Filesize

    84KB

  • memory/2680-132-0x00000000040B0000-0x0000000004139000-memory.dmp

    Filesize

    548KB

  • memory/2680-136-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-135-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-134-0x0000000003D50000-0x0000000003D62000-memory.dmp

    Filesize

    72KB

  • memory/2680-137-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-139-0x0000000003DA0000-0x0000000003DE7000-memory.dmp

    Filesize

    284KB

  • memory/2680-138-0x0000000003DA0000-0x0000000003DE7000-memory.dmp

    Filesize

    284KB

  • memory/2680-142-0x0000000003D60000-0x0000000003D6B000-memory.dmp

    Filesize

    44KB

  • memory/2680-143-0x0000000003D60000-0x0000000003D6B000-memory.dmp

    Filesize

    44KB

  • memory/2680-141-0x0000000003D70000-0x0000000003D77000-memory.dmp

    Filesize

    28KB

  • memory/2680-140-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-144-0x0000000003D50000-0x0000000003D67000-memory.dmp

    Filesize

    92KB

  • memory/2680-146-0x0000000003D50000-0x0000000003D65000-memory.dmp

    Filesize

    84KB

  • memory/2680-145-0x0000000003D50000-0x0000000003D65000-memory.dmp

    Filesize

    84KB

  • memory/2680-147-0x0000000003D50000-0x0000000003D67000-memory.dmp

    Filesize

    92KB

  • memory/2680-149-0x0000000003D50000-0x0000000003D69000-memory.dmp

    Filesize

    100KB

  • memory/2680-148-0x0000000003D50000-0x0000000003D69000-memory.dmp

    Filesize

    100KB

  • memory/2680-150-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-151-0x0000000003D50000-0x0000000003D6B000-memory.dmp

    Filesize

    108KB

  • memory/2680-153-0x0000000003D50000-0x0000000003D5B000-memory.dmp

    Filesize

    44KB

  • memory/2680-152-0x0000000003DA0000-0x0000000003DE7000-memory.dmp

    Filesize

    284KB

  • memory/2680-155-0x0000000003D50000-0x0000000003D59000-memory.dmp

    Filesize

    36KB

  • memory/2680-154-0x0000000003D60000-0x0000000003D6B000-memory.dmp

    Filesize

    44KB

  • memory/2680-156-0x0000000003D50000-0x0000000003D65000-memory.dmp

    Filesize

    84KB

  • memory/2680-158-0x0000000003FC0000-0x000000000403B000-memory.dmp

    Filesize

    492KB

  • memory/2680-157-0x0000000003FC0000-0x000000000403B000-memory.dmp

    Filesize

    492KB

  • memory/2680-161-0x0000000003DA0000-0x0000000003DE8000-memory.dmp

    Filesize

    288KB

  • memory/2680-160-0x0000000003DA0000-0x0000000003DE8000-memory.dmp

    Filesize

    288KB

  • memory/2680-159-0x0000000003D50000-0x0000000003D69000-memory.dmp

    Filesize

    100KB

  • memory/2680-162-0x0000000003D50000-0x0000000003D6B000-memory.dmp

    Filesize

    108KB

  • memory/2680-164-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-163-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-165-0x0000000003D50000-0x0000000003D5B000-memory.dmp

    Filesize

    44KB

  • memory/2680-167-0x0000000003D50000-0x0000000003D61000-memory.dmp

    Filesize

    68KB

  • memory/2680-166-0x0000000003D50000-0x0000000003D61000-memory.dmp

    Filesize

    68KB

  • memory/2680-170-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-169-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-168-0x0000000003D50000-0x0000000003D59000-memory.dmp

    Filesize

    36KB

  • memory/2680-173-0x0000000003D50000-0x0000000003D5A000-memory.dmp

    Filesize

    40KB

  • memory/2680-172-0x0000000003D50000-0x0000000003D5A000-memory.dmp

    Filesize

    40KB

  • memory/2680-171-0x0000000003FC0000-0x000000000403B000-memory.dmp

    Filesize

    492KB

  • memory/2680-177-0x0000000003D60000-0x0000000003D68000-memory.dmp

    Filesize

    32KB

  • memory/2680-176-0x0000000003D60000-0x0000000003D68000-memory.dmp

    Filesize

    32KB

  • memory/2680-175-0x0000000003DA0000-0x0000000003DE8000-memory.dmp

    Filesize

    288KB

  • memory/2680-174-0x0000000003DA0000-0x0000000003DE8000-memory.dmp

    Filesize

    288KB

  • memory/2680-178-0x0000000003D50000-0x0000000003D57000-memory.dmp

    Filesize

    28KB

  • memory/2680-179-0x0000000003DA0000-0x0000000003DEC000-memory.dmp

    Filesize

    304KB

  • memory/2680-180-0x0000000003DA0000-0x0000000003DEC000-memory.dmp

    Filesize

    304KB

  • memory/2680-182-0x0000000003D50000-0x0000000003D61000-memory.dmp

    Filesize

    68KB

  • memory/2680-181-0x0000000003D50000-0x0000000003D61000-memory.dmp

    Filesize

    68KB

  • memory/2680-184-0x0000000003D80000-0x0000000003D90000-memory.dmp

    Filesize

    64KB

  • memory/2680-183-0x0000000003D80000-0x0000000003D90000-memory.dmp

    Filesize

    64KB

  • memory/2680-188-0x0000000003DA0000-0x0000000003DA4000-memory.dmp

    Filesize

    16KB

  • memory/2680-187-0x0000000003DA0000-0x0000000003DA4000-memory.dmp

    Filesize

    16KB

  • memory/2680-186-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-185-0x0000000003D50000-0x0000000003D6E000-memory.dmp

    Filesize

    120KB

  • memory/2680-192-0x0000000003DA0000-0x0000000003DA4000-memory.dmp

    Filesize

    16KB

  • memory/2680-191-0x0000000003DA0000-0x0000000003DA4000-memory.dmp

    Filesize

    16KB

  • memory/2680-190-0x0000000003D50000-0x0000000003D5A000-memory.dmp

    Filesize

    40KB

  • memory/2680-189-0x0000000003D50000-0x0000000003D5A000-memory.dmp

    Filesize

    40KB

  • memory/2680-193-0x0000000003D60000-0x0000000003D68000-memory.dmp

    Filesize

    32KB

  • memory/2680-195-0x0000000003DA0000-0x0000000003DB7000-memory.dmp

    Filesize

    92KB

  • memory/2680-194-0x0000000003D60000-0x0000000003D68000-memory.dmp

    Filesize

    32KB

  • memory/2680-196-0x0000000003DA0000-0x0000000003DB7000-memory.dmp

    Filesize

    92KB

  • memory/2680-197-0x0000000003DA0000-0x0000000003DEC000-memory.dmp

    Filesize

    304KB

  • memory/2680-199-0x0000000003DA0000-0x0000000003DBD000-memory.dmp

    Filesize

    116KB

  • memory/2680-198-0x0000000003DA0000-0x0000000003DEC000-memory.dmp

    Filesize

    304KB