Overview
overview
10Static
static
10lab_sample...5b.exe
windows7-x64
7lab_sample...5b.exe
windows10-2004-x64
7lab_sample...82.exe
windows7-x64
8lab_sample...82.exe
windows10-2004-x64
8lab_sample...63.exe
windows7-x64
10lab_sample...63.exe
windows10-2004-x64
10lab_sample...15.exe
windows7-x64
1lab_sample...15.exe
windows10-2004-x64
1lab_sample...c7.exe
windows7-x64
3lab_sample...c7.exe
windows10-2004-x64
7lab_sample...fc.exe
windows7-x64
6lab_sample...fc.exe
windows10-2004-x64
6Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-06-2024 00:05
Behavioral task
behavioral1
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
lab_samples/1e3966e77ad1cbf3e3ef76803fbf92300b2b88af39650a1208520e0cdc05645b.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
lab_samples/6562e2ac60afa314cd463f771fcfb8be70f947f6e2b314b0c48187eebb33dd82.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
lab_samples/6d34ded00c0da9887ba752872093f59c649de72a1f629a32014f5ed8be509363.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
lab_samples/a380617cf945ca35dbbc3d031bcc612f0dca96c1027a75003182ba5be2851215.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
lab_samples/b3b3bb519dd34a933a0b9920fa905ecaa5ce32c34871a29b5823a5b0fd4d9fc7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Resource
win10v2004-20240508-en
General
-
Target
lab_samples/e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
-
Size
172KB
-
MD5
6e5654da58c03df6808466f0197207ed
-
SHA1
594f33ad9d7f85625a88c24903243ba9788fba86
-
SHA256
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc
-
SHA512
6542a42528f11085376ba893615cd7b68b37e1c78427c678db658e6174ca8d0ac893b071aa55e8d3924a6a2235657322eadf025f10e26c4a0c9858e3c12eb264
-
SSDEEP
3072:qZkKstjomW1XBJqhhPQa77l79KQXF6yvf4FkbmB7VU2fMa+:zvUmgqkm9KQXF6yvwCbu7gT
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exedescription pid process target process PID 2684 set thread context of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe -
Modifies registry class 12 IoCs
Processes:
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\ProgID e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\ProgID\ = "WordAutomation.Application" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\InprocHandler32 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\InprocHandler32\ = "ole32.dll" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WordAutomation.Application e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C} e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\ = "WordAutomation.Application" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WordAutomation.Application\CLSID\ = "{0CBEEE22-BEBF-11D8-82B9-0001028D890C}" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\LAB_SA~1\\E30B76~1.EXE" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WordAutomation.Application\ = "WordAutomation.Application" e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WordAutomation.Application\CLSID e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0CBEEE22-BEBF-11D8-82B9-0001028D890C}\LocalServer32 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exepid process 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exepid process 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exedescription pid process target process PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe PID 2684 wrote to memory of 2792 2684 e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lab_samples\e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe"C:\Users\Admin\AppData\Local\Temp\lab_samples\e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lab_samples\e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exeC:\Users\Admin\AppData\Local\Temp\lab_samples\e30b76f9454a5fd3d11b5792ff93e56c52bf5dfba6ab375c3b96e17af562f5fc.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-1-0x0000000000270000-0x0000000000275000-memory.dmpFilesize
20KB
-
memory/2792-0-0x0000000000300000-0x0000000000400000-memory.dmpFilesize
1024KB
-
memory/2792-20-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-25-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2792-19-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-18-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-16-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-14-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-12-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-10-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-8-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-4-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-6-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-2-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-24-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB
-
memory/2792-26-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/2792-28-0x0000000000400000-0x0000000000DC4000-memory.dmpFilesize
9.8MB