Overview

overview

7

Static

static

3

MegaHack v...UP.exe

windows7-x64

7

MegaHack v...UP.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    64s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    20/05/2023, 17:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    MegaHack v5.4 SETUP.exe

  • Size

    14.6MB

  • MD5

    21f8588ba383393390d76ca642d73183

  • SHA1

    292d500d0ab46c701b33a93284e99a5144078be6

  • SHA256

    85f9e216a24dd777f8e4b7db008128d402355eb93a316fa6ba6c6d8392720a19

  • SHA512

    6426425fcf4ca0ae1ebfbc5b1b91f86a4b9a1bb7a9dc1f648879d3f810c1e5a36d0f3b56effe1f204d0e1847eb93b0ca00fd7c5c2899a8097268f9eddfcbcbd0

  • SSDEEP

    393216:mEGDkj4i79yFTB3HWNmHrjAbh6pBKzd25iFsmF5cISZH:mnA/EFTB3RHyzQxmF5C

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MegaHack v5.4 SETUP.exe
    "C:\Users\Admin\AppData\Local\Temp\MegaHack v5.4 SETUP.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\AppData\Local\Temp\is-8E8JF.tmp\MegaHack v5.4 SETUP.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8E8JF.tmp\MegaHack v5.4 SETUP.tmp" /SL5="$80022,15016215,57856,C:\Users\Admin\AppData\Local\Temp\MegaHack v5.4 SETUP.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:1948
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1532
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0xc4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1076

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\Mega Hack\is-8NS50.tmp
            Filesize

            232KB

            MD5

            ca8b5dba03f3a1ecc3901d156251f590

            SHA1

            dda8a51fe14e793cd1498bff2b0f07f029f6b7c4

            SHA256

            d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05

            SHA512

            bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\is-8E8JF.tmp\MegaHack v5.4 SETUP.tmp
            Filesize

            697KB

            MD5

            832dab307e54aa08f4b6cdd9b9720361

            SHA1

            ebd007fb7482040ecf34339e4bf917209c1018df

            SHA256

            cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

            SHA512

            358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\is-8E8JF.tmp\MegaHack v5.4 SETUP.tmp
            Filesize

            697KB

            MD5

            832dab307e54aa08f4b6cdd9b9720361

            SHA1

            ebd007fb7482040ecf34339e4bf917209c1018df

            SHA256

            cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

            SHA512

            358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

            Download Submit

          • \Users\Admin\AppData\Local\Temp\is-8E8JF.tmp\MegaHack v5.4 SETUP.tmp
            Filesize

            697KB

            MD5

            832dab307e54aa08f4b6cdd9b9720361

            SHA1

            ebd007fb7482040ecf34339e4bf917209c1018df

            SHA256

            cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3

            SHA512

            358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49

            Download Submit

          • memory/1948-62-0x00000000001D0000-0x00000000001D1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1948-64-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1948-94-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1948-100-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1948-105-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1948-210-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1948-212-0x0000000000400000-0x00000000004BE000-memory.dmp

            Filesize

            760KB

            Download

          • memory/1984-63-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

            Download

          • memory/1984-54-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

            Download

          • memory/1984-213-0x0000000000400000-0x0000000000415000-memory.dmp

            Filesize

            84KB

            Download