Overview
overview
10Static
static
100468a48ea4...66.exe
windows7-x64
100468a48ea4...66.exe
windows10-2004-x64
1004a0d422bf...89.exe
windows7-x64
1004a0d422bf...89.exe
windows10-2004-x64
1004b096c64a...8c.exe
windows7-x64
1004b096c64a...8c.exe
windows10-2004-x64
1004f053e37f...9e.exe
windows7-x64
704f053e37f...9e.exe
windows10-2004-x64
7051d54e80e...d9.exe
windows7-x64
10051d54e80e...d9.exe
windows10-2004-x64
10055434cfbf...10.exe
windows7-x64
10055434cfbf...10.exe
windows10-2004-x64
10056237071f...6f.exe
windows7-x64
8056237071f...6f.exe
windows10-2004-x64
805bc9e2415...85.exe
windows7-x64
1005bc9e2415...85.exe
windows10-2004-x64
10063e970822...53.exe
windows7-x64
10063e970822...53.exe
windows10-2004-x64
10067dba33ec...10.exe
windows7-x64
10067dba33ec...10.exe
windows10-2004-x64
10069e1d61a6...6c.exe
windows7-x64
7069e1d61a6...6c.exe
windows10-2004-x64
706abb382ad...1f.exe
windows7-x64
1006abb382ad...1f.exe
windows10-2004-x64
10070c765850...3b.exe
windows7-x64
10070c765850...3b.exe
windows10-2004-x64
10071dc8716c...f5.exe
windows7-x64
10071dc8716c...f5.exe
windows10-2004-x64
10071eca8631...c1.exe
windows7-x64
10071eca8631...c1.exe
windows10-2004-x64
100736e2c073...47.exe
windows7-x64
100736e2c073...47.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:17
Behavioral task
behavioral1
Sample
0468a48ea4ffed32e73c71ffa2625366.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
0468a48ea4ffed32e73c71ffa2625366.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
04a0d422bfab50b323946c739913ca997a3d00e1c87bb102be934c914713b989.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
04a0d422bfab50b323946c739913ca997a3d00e1c87bb102be934c914713b989.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
04b096c64a6eb8b5b007dc43f98de1de21532931bce3480c452193514e74a88c.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
04b096c64a6eb8b5b007dc43f98de1de21532931bce3480c452193514e74a88c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
051d54e80e3f28743c56367890e0952fad3e6bfa88e8774b24c6c2c714840dd9.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
055434cfbf05d012a80abe18c0849d10.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
055434cfbf05d012a80abe18c0849d10.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
056237071f0dd2efe7935111ddc88a6f.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral14
Sample
056237071f0dd2efe7935111ddc88a6f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
05bc9e241595cfb8331b3a2206ccd183c0419bbc06afdc5a6c89f1eb83180e85.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
05bc9e241595cfb8331b3a2206ccd183c0419bbc06afdc5a6c89f1eb83180e85.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
063e9708222c323c44aac51f2f7add53.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
063e9708222c323c44aac51f2f7add53.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
067dba33ec6de2a7e733bb64a32ebb10.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral20
Sample
067dba33ec6de2a7e733bb64a32ebb10.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
069e1d61a61a6b7eaf2df36bcaf7419205504f4a5d83d82f096ba0f1117f5e6c.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
069e1d61a61a6b7eaf2df36bcaf7419205504f4a5d83d82f096ba0f1117f5e6c.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
06abb382ad59957f5f38c5c099a3b51f.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
06abb382ad59957f5f38c5c099a3b51f.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral26
Sample
070c765850e2f2bdfda3f7dc34b78fee9ceaedbe535aa29feec8e63afb5e3e3b.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
071dc8716c274c05bbebc4900432b8298ad34c138c446fdc7c4144ba9a68fff5.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral28
Sample
071dc8716c274c05bbebc4900432b8298ad34c138c446fdc7c4144ba9a68fff5.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
071eca863103f782de4c5c0b02cd7aba3d8d15e7f44a9c412385b10c1499c7c1.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral30
Sample
071eca863103f782de4c5c0b02cd7aba3d8d15e7f44a9c412385b10c1499c7c1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
0736e2c073088395349f1f3c923c211f0d62fcd794181a9dbf6d5366cabc6647.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral32
Sample
0736e2c073088395349f1f3c923c211f0d62fcd794181a9dbf6d5366cabc6647.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
General
-
Target
04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe
-
Size
1.4MB
-
MD5
29683f5b4ad272c624cc2069e9b39573
-
SHA1
dab6f53e6bf60cdd6ee20850235a85a10d57f28b
-
SHA256
04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e
-
SHA512
0ea2b3e67766f36d202850b5ad639383285eb93c7f626430b20f40990bd2a7e5f405ec91b782f3e1b12bc255a7637831114df06f753c039bf8774946752a48e5
-
SSDEEP
24576:n8dvIOVmW6AbPsArkueRKmV3sNlHfiqJIu7:nowONbkBuyKmBs7iu7
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe -
Drops startup file 4 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app_signed.exe 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app_signed.exe 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe -
Executes dropped EXE 3 IoCs
pid Process 4976 app.exe 1652 app.exe 2972 app.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\app.exe" 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4976 set thread context of 2972 4976 app.exe 104 PID 4976 set thread context of 1652 4976 app.exe 105 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language app.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 4976 app.exe 4976 app.exe 4976 app.exe 4976 app.exe 4976 app.exe 4976 app.exe 4976 app.exe 4976 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe 2972 app.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe Token: SeDebugPrivilege 4976 app.exe Token: SeDebugPrivilege 2972 app.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2972 app.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1788 wrote to memory of 4976 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 94 PID 1788 wrote to memory of 4976 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 94 PID 1788 wrote to memory of 4976 1788 04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe 94 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 2972 4976 app.exe 104 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 1652 4976 app.exe 105 PID 4976 wrote to memory of 1652 4976 app.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe"C:\Users\Admin\AppData\Local\Temp\04f053e37f7e0f8045fa590614b885ae3a2ecbd55fe48d886ea6563429fe1a9e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2972
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5778c6d0a1dd0c6c5ce12302752c064d1
SHA152caefc352574c957730b4492a775e3b8bc56e36
SHA256aeba9942f03d3902e757c78b2a0c60d8e784d4dfd0aff8e64868a1227067e298
SHA51211c9f3acf0f1794c91e7c56cee67a3b976f43bc04f73b9321c5794e88151e5ffa5f95cc27ec6268ee545c1afd98214b019a0c2cd9dce9988933559222ab33200