e0452f10317c73fcbdc525e383a6feed28d0a36edc411b1aaf3ce3f03ea33b7e

Resubmissions

01-04-2023 10:24

230401-mfw3fshd52 7

31-03-2023 11:34

230331-nplthsah3s 7

Analysis

max time kernel
134s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20230220-ja
resource tags

arch:x64arch:x86image:win10v2004-20230220-jalocale:ja-jpos:windows10-2004-x64systemwindows
submitted
31-03-2023 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mlo.exe
Size

5.7MB
MD5

8a96d6617d28155a2cb2c74aa895a599
SHA1

f015fc339f6d2c8a8c03c792c2482ee1d4dcd62f
SHA256

e0452f10317c73fcbdc525e383a6feed28d0a36edc411b1aaf3ce3f03ea33b7e
SHA512

d79223635118c92269def85b91865d236c1e9099d2e8af02287f772aaf7694ac086c1858c2c93f02768fb4c97edcfcfcdba1f1920c3f9832f0665b4c89710d26
SSDEEP

98304:tVUFMKoQPGk9pxrXIDaazYFjED6D7TeiS2tcZrcIu20rFrJpFBU6JrHw7tEqa:tVeRo2GmBXI+aqjwqSqcZhuBrJ7BytEr

Score

1^/10

Malware Config

Signatures

Modifies registry class 9 IoCs

Processes:

mlo.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\shell\open	mlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mlo.exe"	mlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\URL Protocol	mlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\shell\open\command	mlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\shell	mlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\DefaultIcon	mlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\ = "MyLifeOrganized Protocol Handler"	mlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo	mlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mlo\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\mlo.exe\" -url \"%1\""	mlo.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

mlo.exe

pid process

2312 mlo.exe
Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

mlo.exe

pid process

2312 mlo.exe
2312 mlo.exe
2312 mlo.exe
2312 mlo.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

mlo.exe

pid process

2312 mlo.exe
2312 mlo.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

mlo.exe

pid process

2312 mlo.exe
2312 mlo.exe

pid	process
2312	mlo.exe

pid	process
2312	mlo.exe
2312	mlo.exe
2312	mlo.exe
2312	mlo.exe

pid	process
2312	mlo.exe
2312	mlo.exe

pid	process
2312	mlo.exe
2312	mlo.exe

C:\Users\Admin\AppData\Local\Temp\mlo.exe
"C:\Users\Admin\AppData\Local\Temp\mlo.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2312-133-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-134-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-135-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-136-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-137-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-138-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-139-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-140-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-141-0x0000000001790000-0x0000000001791000-memory.dmp

Filesize
4KB

Download
memory/2312-149-0x0000000006830000-0x0000000006831000-memory.dmp

Filesize
4KB

Download
memory/2312-150-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-152-0x0000000001790000-0x0000000001791000-memory.dmp

Filesize
4KB

Download
memory/2312-154-0x0000000006830000-0x0000000006831000-memory.dmp

Filesize
4KB

Download
memory/2312-155-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-156-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-157-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-158-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-159-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-161-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-162-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-163-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-164-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-165-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download
memory/2312-166-0x0000000000400000-0x0000000001452000-memory.dmp

Filesize
16.3MB

Download