8b0f9d248e67199bb7f1a778a03e4caee7d267e61d8a7d70fa1c1f6d7944e96a

Resubmissions

28/03/2025, 16:52

250328-vdc6kazry9 9

24/03/2025, 22:22

250324-2aphra1jx7 10

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 16:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
Size

510KB
MD5

565dacda99cc8d28d3e650b4d85e8d24
SHA1

6c5f2ab498ae16332a3863e45d35e47e1aabe001
SHA256

343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303
SHA512

534eeda2e7c99ffef2bf023aa3f68739953ecbdfabcd57ad41af08c8c563fe27f7f8be04e80bdc2904ed0632984968551ddb107917fbe6dfc7a0e704af313946
SSDEEP

12288:M7iBDowvTfS6ublBri5g3D7eJit/mUZ5jI0B57g3l1TV0:/EkStbjfdteUZ+0BQ7TV

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 29 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ osk.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ narrator.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ magnify.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ utilman.exe	SURVEY~2.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ sethc.exe\Debugger = "alg.exe"	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ iexplore.exe	SURVEY~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	SURVEY~2.EXE

Executes dropped EXE 1 IoCs

pid	Process
1376	SURVEY~2.EXE

Modifies system executable filetype association 2 TTPs 12 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	SURVEY~2.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\oobe\info\backgrounds\backgroundDefault.jpg	SURVEY~2.EXE
File opened for modification	C:\Windows\system32\oobe\info\backgrounds\backgroundDefault.jpg	SURVEY~2.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SURVEY~2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\PersistentHandler	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	SURVEY~2.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	SURVEY~2.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1376	SURVEY~2.EXE
1376	SURVEY~2.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1376	SURVEY~2.EXE
1376	SURVEY~2.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 1376	5732	343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe	88
PID 5732 wrote to memory of 1376	5732	343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe	88
PID 5732 wrote to memory of 1376	5732	343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe	88
PID 3228 wrote to memory of 1764	3228	cmd.exe	89
PID 3228 wrote to memory of 1764	3228	cmd.exe	89
PID 1376 wrote to memory of 3968	1376	SURVEY~2.EXE	90
PID 1376 wrote to memory of 3968	1376	SURVEY~2.EXE	90
PID 1376 wrote to memory of 3968	1376	SURVEY~2.EXE	90
PID 1376 wrote to memory of 2976	1376	SURVEY~2.EXE	91
PID 1376 wrote to memory of 2976	1376	SURVEY~2.EXE	91
PID 1376 wrote to memory of 2976	1376	SURVEY~2.EXE	91

System policy modification 1 TTPs 9 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	SURVEY~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1"	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1"	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys = "1"	SURVEY~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	SURVEY~2.EXE

C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
"C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "ftype asriel=alg "%1""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "assoc .exe=asriel"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
  2⤵
  PID:1764

C:\Windows\system32\alg.exe
alg.exe explorer.exe
1⤵
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE

Filesize
381KB

MD5
9fb609d65c73bf9d91ba19dd35b02fd3

SHA1
081e3cdf4ff535fde9861b5941d461f1c0b8e8ef

SHA256
a559cc64348b108b1d6bc4194cd05c7e23d72aed07fe469f1ca175e4405a873b

SHA512
4d3bac285e9529895583c07cc885d0f1d38586e477513f9f66f3a7da2b9c3280706feb1391b491f18fcb3385316a1e86151a80cac3a73a7c16999c405e2ba89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\home.htm

Filesize
183B

MD5
ec974d8dcb26e1462ef53a780acbeeaf

SHA1
edcaf178d0e5697967363e9e91a11ac01e9351e0

SHA256
30ad9f411bdf68fb4e683326d167c6e098e800438ae87fa48401ef918c45b81a

SHA512
159e01452fbb09d92ce3bf0059bf14d9acd956e0ceb7e7b9a0f7311e0432bfc0b232a4102a4ffe6f539200440eb44cf1f421385dcdc3411596d48b0d7e6f5694

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zebg.jpg

Filesize
107KB

MD5
6a0c11b9977e9aca6083bd5f7ed7d501

SHA1
cec8b3eaa2a8ff74a447a69c23afffde6e7bb278

SHA256
d4cbab9fbfe4f58322dde41ced37c68288c94334399a50daa559898679dab188

SHA512
28a3f1993d2af4e6e7fcace42d34401d983ce46d897e257c314519e7c132897bb1cdc377fef48889efbecb93c3a85ab0629cd400f3905341a4415f428a928c85

Download Submit
memory/1376-12-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/1376-13-0x0000000000990000-0x0000000000993000-memory.dmp

Filesize
12KB

Download
memory/1376-25-0x0000000000400000-0x00000000004F5000-memory.dmp

Filesize
980KB

Download
memory/5732-0-0x0000000000AB0000-0x0000000000B4F000-memory.dmp

Filesize
636KB

Download
memory/5732-1-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/5732-23-0x00000000001E0000-0x00000000001E3000-memory.dmp

Filesize
12KB

Download
memory/5732-24-0x0000000000AB0000-0x0000000000B4F000-memory.dmp

Filesize
636KB

Download