70bba6e748b04c937188f113389a3c90bf30806add70222b920886a57b0bdd98

Analysis

max time kernel
123s
max time network
138s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12085ebb04414916835a2dbcd2cdfa95.exe
Size

27.7MB
MD5

12085ebb04414916835a2dbcd2cdfa95
SHA1

0d38b164e8346878d58c8abfc0bddfe558c7880a
SHA256

5c2c1e644e9ce1a00f3b7893bdc1c49c66f0a7e8f7f9f655a1b238cc589cfbba
SHA512

ef256cd5694c5d336fdffd7b9d1c6bffe271f765c5f6b25e5722a7eb9095d719b18505ba9e47d848a5131cf842ed50f9dcca0eb9e43f1f7a4a1a629aa74b1108
SSDEEP

393216:BAjXuTDSvfGJ8uGAAPXV8D4hSBG7LJQkL1JnsXjRBZcs5eH9MKgzUa6n5Q6LEBwS:4XuCHGJTk6G76kgFVM9MKbb6vpJ3ckMe

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2220	cmd.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NET25.lnk	12085ebb04414916835a2dbcd2cdfa95.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12085ebb04414916835a2dbcd2cdfa95.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2948	timeout.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\_auto_file\	rundll32.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2496	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	12085ebb04414916835a2dbcd2cdfa95.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2496	1320	12085ebb04414916835a2dbcd2cdfa95.exe	31
PID 1320 wrote to memory of 2496	1320	12085ebb04414916835a2dbcd2cdfa95.exe	31
PID 1320 wrote to memory of 2496	1320	12085ebb04414916835a2dbcd2cdfa95.exe	31
PID 1320 wrote to memory of 2496	1320	12085ebb04414916835a2dbcd2cdfa95.exe	31
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2928	1320	12085ebb04414916835a2dbcd2cdfa95.exe	33
PID 1320 wrote to memory of 2220	1320	12085ebb04414916835a2dbcd2cdfa95.exe	34
PID 1320 wrote to memory of 2220	1320	12085ebb04414916835a2dbcd2cdfa95.exe	34
PID 1320 wrote to memory of 2220	1320	12085ebb04414916835a2dbcd2cdfa95.exe	34
PID 1320 wrote to memory of 2220	1320	12085ebb04414916835a2dbcd2cdfa95.exe	34
PID 2220 wrote to memory of 2948	2220	cmd.exe	36
PID 2220 wrote to memory of 2948	2220	cmd.exe	36
PID 2220 wrote to memory of 2948	2220	cmd.exe	36
PID 2220 wrote to memory of 2948	2220	cmd.exe	36
PID 2928 wrote to memory of 2676	2928	rundll32.exe	37
PID 2928 wrote to memory of 2676	2928	rundll32.exe	37
PID 2928 wrote to memory of 2676	2928	rundll32.exe	37
PID 2928 wrote to memory of 2676	2928	rundll32.exe	37

C:\Users\Admin\AppData\Local\Temp\12085ebb04414916835a2dbcd2cdfa95.exe
"C:\Users\Admin\AppData\Local\Temp\12085ebb04414916835a2dbcd2cdfa95.exe"
1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\ProgramData\NETFLIX2025\NET25" /st 06:14 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2496
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\ProgramData\NETFLIX2025\NET25
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\ProgramData\NETFLIX2025\NET25"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp48C3.tmp.cmd""
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\timeout.exe
    timeout 6
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\NETFLIX2025\NET25

Filesize
28.9MB

MD5
717859e288f8d02e2cb13e1f54575481

SHA1
dea93a8d6cc009822356714e0fb08f81094de167

SHA256
81b2b80642d9d9d9351c7a61fe2aa3807cb8db6edff0e222f35c1de863b05bb2

SHA512
cd78d01f20691cee0c30209923a014997247d6a9a86485ee6e8f1c02e1a717a72b217273b2aedf9f5b607ee36f749e6f4fb93f4b6309881423ee51067e22218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp48C3.tmp.cmd

Filesize
184B

MD5
0bbf9e9d68b3f879b00c79cee09178e5

SHA1
6bfe693bcc9ec2136329e9feed053f85737bbd31

SHA256
50faf25e8730e78c01701428c702ab3111a78b2e871e882390f53d13cdb85b0b

SHA512
7c470e05bc468d3f824c094ad26e7c99386c1137ce5cfab2bb146b654564d237e3498428324574cce0c150071be8a372550df200b6bc3377449b2d1560418545

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c856674c3447c5bbc1931d4bce01fe3a

SHA1
5ddd1396b7d25604faa583f7ab837822ec76897b

SHA256
3a2f9e058bbbe61464c10230005ed79e886c3f99c7a5a2450e9169871a331098

SHA512
4eecb20ac1d1172b0aa997d66f29cb609640a5f9c093dda382ecb8b7efeff6c4961199207134f7821f6181348dab9510614dc6be55468126495ed38a3980cbc2

Download Submit
memory/1320-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download
memory/1320-1-0x0000000000210000-0x0000000000410000-memory.dmp

Filesize
2.0MB

Download
memory/1320-2-0x00000000749FE000-0x00000000749FF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads