8b0f9d248e67199bb7f1a778a03e4caee7d267e61d8a7d70fa1c1f6d7944e96a

Resubmissions

28/03/2025, 16:52

250328-vdc6kazry9 9

24/03/2025, 22:22

250324-2aphra1jx7 10

Analysis

max time kernel
895s
max time network
863s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2025, 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
Size

107KB
MD5

7d51abf861c7d1de546b7fddc1800e01
SHA1

d6bbf02ec922ba035d863ec813221f15ab4c2bfb
SHA256

42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7
SHA512

068893628cc9e46117866e2526bb57cea6c13f898e930c3366fcfab457807673270e3f9b4b8740b99c15f521adc775970d5d2a505f2270980805dfc705ddc7e6
SSDEEP

3072:nAsj8MBX8s0oXJ4455EGag707Igl8BTs6bdr:nAsBZyyhaS07Igl8BTsYr

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\service.exe"	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2636 set thread context of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93
PID 2636 wrote to memory of 752	2636	42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe	93

C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
"C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe
  "C:\Users\Admin\AppData\Local\Temp\42d77128db6bea33966478f01aecda1cf6c17bf9ab5d5782650c1b32cd63bae7.exe"
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsh664D.tmp\System.dll

Filesize
11KB

MD5
883eff06ac96966270731e4e22817e11

SHA1
523c87c98236cbc04430e87ec19b977595092ac8

SHA256
44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82

SHA512
60333253342476911c84bbc1d9bf8a29f811207787fdd6107dce8d2b6e031669303f28133ffc811971ed7792087fe90fb1faabc0af4e91c298ba51e28109a390

Download Submit
C:\Users\Admin\AppData\Roaming\NsResize.dll

Filesize
61KB

MD5
543a9f0c51f22aac338722a03fd57bdd

SHA1
cb0ac20b3c6b14c893608cdde4f70354fda95b8e

SHA256
1cbd41a53f7d6fec146de933dad6443c274c072aac0ba289cc4c58405eeb2c26

SHA512
f83666984e220e83db6a67488ceba671aa4310e1d0f74510b1dc0b0fc44918ab5fb7fc927d11f27a03a3ba067c33d47b5b452486f4de28f65050ad5af01a4329

Download Submit
memory/752-14-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/752-18-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/752-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/752-29-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/752-30-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2636-11-0x0000000003050000-0x0000000003066000-memory.dmp

Filesize
88KB

Download
memory/2636-15-0x0000000003050000-0x0000000003066000-memory.dmp

Filesize
88KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads