f08d555b265bc840ef4d7904f37de7886b276d3b2f85180bb63b0e29445e02b1

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c949630c94733e122dc321316d68ca1f.exe
Size

30.1MB
MD5

c949630c94733e122dc321316d68ca1f
SHA1

cd30c22e274de0149544d1889a4402c067daf212
SHA256

09455ae9bbc99b19bd191d6a1e8454dbf5d299e229e70520852dfa4b37905205
SHA512

902ad50640283fe67c3d05fc892c204eca0c79f9b1fb5952d11d25d3ec4a499b3de56c599b4a2e92203a5468ef51a983ff8dde333b8143cab1fe4828bccc78ea
SSDEEP

786432:4X9YkEvofjPaeA8NOqZWryVB41efzsB4si4inK+:SYkyWji4CkgP3Ex

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2744	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NET25.lnk	c949630c94733e122dc321316d68ca1f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c949630c94733e122dc321316d68ca1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2660	timeout.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\_auto_file	rundll32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2200	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1928	c949630c94733e122dc321316d68ca1f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2200	1928	c949630c94733e122dc321316d68ca1f.exe	31
PID 1928 wrote to memory of 2200	1928	c949630c94733e122dc321316d68ca1f.exe	31
PID 1928 wrote to memory of 2200	1928	c949630c94733e122dc321316d68ca1f.exe	31
PID 1928 wrote to memory of 2200	1928	c949630c94733e122dc321316d68ca1f.exe	31
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 3064	1928	c949630c94733e122dc321316d68ca1f.exe	33
PID 1928 wrote to memory of 2744	1928	c949630c94733e122dc321316d68ca1f.exe	34
PID 1928 wrote to memory of 2744	1928	c949630c94733e122dc321316d68ca1f.exe	34
PID 1928 wrote to memory of 2744	1928	c949630c94733e122dc321316d68ca1f.exe	34
PID 1928 wrote to memory of 2744	1928	c949630c94733e122dc321316d68ca1f.exe	34
PID 2744 wrote to memory of 2660	2744	cmd.exe	36
PID 2744 wrote to memory of 2660	2744	cmd.exe	36
PID 2744 wrote to memory of 2660	2744	cmd.exe	36
PID 2744 wrote to memory of 2660	2744	cmd.exe	36
PID 3064 wrote to memory of 2388	3064	rundll32.exe	37
PID 3064 wrote to memory of 2388	3064	rundll32.exe	37
PID 3064 wrote to memory of 2388	3064	rundll32.exe	37
PID 3064 wrote to memory of 2388	3064	rundll32.exe	37

C:\Users\Admin\AppData\Local\Temp\c949630c94733e122dc321316d68ca1f.exe
"C:\Users\Admin\AppData\Local\Temp\c949630c94733e122dc321316d68ca1f.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\ProgramData\NETFLIX2025\NET25" /st 06:38 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2200
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\ProgramData\NETFLIX2025\NET25
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\ProgramData\NETFLIX2025\NET25"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF805.tmp.cmd""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\timeout.exe
    timeout 6
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NETFLIX2025\NET25

Filesize
31.3MB

MD5
852c3221fd6705637ad28374be5c30d4

SHA1
85b5ec91d7bc7e75526c01b26a866c39571bace5

SHA256
f2dc4a9d9bef78afd9ae51c37d7a54ed989221cf3f4c800882368c4f707ed152

SHA512
7fff666bdd6c2e1d25e888c8c1c7fb9cff3df304f1db04a6e6d408182db1c55df4c2f17b35a7b80c725f2a2e2683e796b1cc269832b1f0ace72cd426d6106ede

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF805.tmp.cmd

Filesize
184B

MD5
13bddc9a3986f2df91159da3b4e7193d

SHA1
4673baeb2bc38868c057de19373a4985363185e6

SHA256
ffe08fcd5634fbfbdecbc22cb1428fdfb825040c6a75824b86de6493074a0f45

SHA512
54f8216cb123d8626b37f11576542fef21eb5e2b271f234a1ef40cd1110a34a0b5b4bfcd4f55f8c1a9617bd98d520a859464cfdc2281b91951c753b4df48b35c

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cc0b5b70e6f134270af1effc21243d0a

SHA1
fc8085eeeb9007b2a48879ec29138b05f5c23258

SHA256
83d64df4c5fd4862992e2fe98a9cc3b998cf00dd400b8b8da979b96af1178fcf

SHA512
f33f2270e336eea650a5b56b03ac5821072a6760a1fa4ceb74345c8e43afa2c6dfbabcf423db5bc548dafbc9d9eb1df03c1aedb7f7b6b59250851e22a35b3d9d

Download Submit
memory/1928-0-0x000000007467E000-0x000000007467F000-memory.dmp

Filesize
4KB

Download
memory/1928-1-0x0000000000E70000-0x0000000001070000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads