Analysis
-
max time kernel
41s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
06-10-2023 21:26
General
-
Target
Mega Hack GD v5.4.exe
-
Size
14.6MB
-
MD5
21f8588ba383393390d76ca642d73183
-
SHA1
292d500d0ab46c701b33a93284e99a5144078be6
-
SHA256
85f9e216a24dd777f8e4b7db008128d402355eb93a316fa6ba6c6d8392720a19
-
SHA512
6426425fcf4ca0ae1ebfbc5b1b91f86a4b9a1bb7a9dc1f648879d3f810c1e5a36d0f3b56effe1f204d0e1847eb93b0ca00fd7c5c2899a8097268f9eddfcbcbd0
-
SSDEEP
393216:mEGDkj4i79yFTB3HWNmHrjAbh6pBKzd25iFsmF5cISZH:mnA/EFTB3RHyzQxmF5C
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 11 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mega Hack GD v5.4.exe"C:\Users\Admin\AppData\Local\Temp\Mega Hack GD v5.4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-7G7J2.tmp\Mega Hack GD v5.4.tmp"C:\Users\Admin\AppData\Local\Temp\is-7G7J2.tmp\Mega Hack GD v5.4.tmp" /SL5="$5014C,15016215,57856,C:\Users\Admin\AppData\Local\Temp\Mega Hack GD v5.4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Mega Hack\MegaHack.exe"C:\Program Files (x86)\Mega Hack\MegaHack.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232KB
MD5ca8b5dba03f3a1ecc3901d156251f590
SHA1dda8a51fe14e793cd1498bff2b0f07f029f6b7c4
SHA256d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05
SHA512bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f
-
Filesize
232KB
MD5ca8b5dba03f3a1ecc3901d156251f590
SHA1dda8a51fe14e793cd1498bff2b0f07f029f6b7c4
SHA256d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05
SHA512bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f
-
Filesize
5.9MB
MD506404c98b8f8a4854be00928d2661553
SHA131c48d3901244169a7a090ca704f3abcac24a419
SHA2567b4e48c1ca2978b8bc6a005906168e6f3ef75c401511eddacf9b5842a56a1893
SHA5129232a07dd419eaeef80739f9624ccc7a358b65801e9c281bd2d4a95e59f7f2275b112aed150ac7ba82792adba1c3edce1b0d0fd3746b4c0cfe3c2bbcdee8e87f
-
Filesize
6.2MB
MD547cd60478b29937e4c062cad74b16807
SHA1592b512e1f78cfb10bf155ad5aedd10890506ad5
SHA256a522369719e5bd8ad08bcebcbdecc10a4b60eacd9f43254e2f31a4e9972bcedc
SHA512cc41506e359b9611c5fff0bce47f7c883538b95864c00dd316bfac8ba97bb20eed97e939958a43ccf53da487a87b2b0fd79f77549d019ba843006cc72ed906f9
-
Filesize
1.7MB
MD5c0e51bf4d6a0fddaa3fe824017b3f05b
SHA17e858d9cd8783a1d752c7839ce0193cedf31a569
SHA25671399010c6a8e4a1a152fb82b25a76901d37ce4698379f1bda50d2334a3b24ac
SHA512bed2bd80eae3b81f2c1b055611ed0e8fb02ff126ba2f19173048baa050faabbbe7718af91df0682f20b807a1a1c4f527f435d241228f8fdf3626f027d6b10b4c
-
Filesize
6.0MB
MD5de81310251ed7fe9df01b78cd27ab63a
SHA1ef0bdbbb73ecd4a3e9398e87ffe4e64ef0ec6d25
SHA25656f10b75f48e7c3e00ba666bd85f07009a4ade0d8d8ca6bc9f4ef76535858985
SHA5126a4d8cb417cb69c1ed9f4ea5e425d7312ea40208a852d4be5fb4f8fb657fd088f5fd527ca5a9fbd398aec806ad4efc4aa56e4ab834c06dcbab585b45016c73ae
-
Filesize
117KB
MD5043b39434829ce93637b1801d57b2082
SHA1297b5f72104130e17d92789adbbcfab8fe700a82
SHA2564d2e2d408d399d066b0aaef2047f7a33515c13c589832de0d9f1ba87a530c394
SHA512eee912b21d31c54bf913d11028f1637a041809bbe4cd6a5ca28c664f72b397d67d03230ba652a06b86916aea7e7ff5999a5b26cc14c067ab1652ab82f565edcf
-
Filesize
1.5MB
MD563b4f37587334014fda842a04b1baae4
SHA186202ab04e3e69daacae4ea2612d5ea6f5f1b256
SHA256544d488fcfd76749c5ef2cd6bf9f73cc9fe59a86a819d369d710cca6e43cf4b1
SHA512f14c708789d64259ac37b9b631949dc29bd1d9e91bfeec1ef716ff13747893dec32c82d95d07a7ee629a9f554e059ccb2286a38d84366406ae4d536f5e318014
-
Filesize
77KB
MD5a8b06665266ff02d5e9847ad828f9ee0
SHA1899ccd262be567d481321b96468e3bcae38cf728
SHA256712003aa990c4f9a1ee3cd044b8fd6abc44531710b7e42688b3767348330564b
SHA5122ccc86b6a44d23039f2344eeb8ac629d0b9671e84a79b11d0f8d13684731a61434fd5509574d15cb03bb1f0714a81a660e0313d5b8962d4a367f5faaae759d17
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
232KB
MD5ca8b5dba03f3a1ecc3901d156251f590
SHA1dda8a51fe14e793cd1498bff2b0f07f029f6b7c4
SHA256d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05
SHA512bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f
-
Filesize
232KB
MD5ca8b5dba03f3a1ecc3901d156251f590
SHA1dda8a51fe14e793cd1498bff2b0f07f029f6b7c4
SHA256d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05
SHA512bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f
-
Filesize
232KB
MD5ca8b5dba03f3a1ecc3901d156251f590
SHA1dda8a51fe14e793cd1498bff2b0f07f029f6b7c4
SHA256d63e28c5ddd74b71f7b2c897f7d373779ac5d2ecb7476b373ddec179ba42cc05
SHA512bd17cb2c0ceac093fa54a7e15d17e87d440550540a9dd3915498f0dfac82474e59247ea5a2d9b4a4d2020f83455a0cd24149694b979699a22f0d106c65ef260f
-
Filesize
5.9MB
MD506404c98b8f8a4854be00928d2661553
SHA131c48d3901244169a7a090ca704f3abcac24a419
SHA2567b4e48c1ca2978b8bc6a005906168e6f3ef75c401511eddacf9b5842a56a1893
SHA5129232a07dd419eaeef80739f9624ccc7a358b65801e9c281bd2d4a95e59f7f2275b112aed150ac7ba82792adba1c3edce1b0d0fd3746b4c0cfe3c2bbcdee8e87f
-
Filesize
6.2MB
MD547cd60478b29937e4c062cad74b16807
SHA1592b512e1f78cfb10bf155ad5aedd10890506ad5
SHA256a522369719e5bd8ad08bcebcbdecc10a4b60eacd9f43254e2f31a4e9972bcedc
SHA512cc41506e359b9611c5fff0bce47f7c883538b95864c00dd316bfac8ba97bb20eed97e939958a43ccf53da487a87b2b0fd79f77549d019ba843006cc72ed906f9
-
Filesize
1.7MB
MD5c0e51bf4d6a0fddaa3fe824017b3f05b
SHA17e858d9cd8783a1d752c7839ce0193cedf31a569
SHA25671399010c6a8e4a1a152fb82b25a76901d37ce4698379f1bda50d2334a3b24ac
SHA512bed2bd80eae3b81f2c1b055611ed0e8fb02ff126ba2f19173048baa050faabbbe7718af91df0682f20b807a1a1c4f527f435d241228f8fdf3626f027d6b10b4c
-
Filesize
6.0MB
MD5de81310251ed7fe9df01b78cd27ab63a
SHA1ef0bdbbb73ecd4a3e9398e87ffe4e64ef0ec6d25
SHA25656f10b75f48e7c3e00ba666bd85f07009a4ade0d8d8ca6bc9f4ef76535858985
SHA5126a4d8cb417cb69c1ed9f4ea5e425d7312ea40208a852d4be5fb4f8fb657fd088f5fd527ca5a9fbd398aec806ad4efc4aa56e4ab834c06dcbab585b45016c73ae
-
Filesize
117KB
MD5043b39434829ce93637b1801d57b2082
SHA1297b5f72104130e17d92789adbbcfab8fe700a82
SHA2564d2e2d408d399d066b0aaef2047f7a33515c13c589832de0d9f1ba87a530c394
SHA512eee912b21d31c54bf913d11028f1637a041809bbe4cd6a5ca28c664f72b397d67d03230ba652a06b86916aea7e7ff5999a5b26cc14c067ab1652ab82f565edcf
-
Filesize
1.5MB
MD563b4f37587334014fda842a04b1baae4
SHA186202ab04e3e69daacae4ea2612d5ea6f5f1b256
SHA256544d488fcfd76749c5ef2cd6bf9f73cc9fe59a86a819d369d710cca6e43cf4b1
SHA512f14c708789d64259ac37b9b631949dc29bd1d9e91bfeec1ef716ff13747893dec32c82d95d07a7ee629a9f554e059ccb2286a38d84366406ae4d536f5e318014
-
Filesize
77KB
MD5a8b06665266ff02d5e9847ad828f9ee0
SHA1899ccd262be567d481321b96468e3bcae38cf728
SHA256712003aa990c4f9a1ee3cd044b8fd6abc44531710b7e42688b3767348330564b
SHA5122ccc86b6a44d23039f2344eeb8ac629d0b9671e84a79b11d0f8d13684731a61434fd5509574d15cb03bb1f0714a81a660e0313d5b8962d4a367f5faaae759d17
-
Filesize
697KB
MD5832dab307e54aa08f4b6cdd9b9720361
SHA1ebd007fb7482040ecf34339e4bf917209c1018df
SHA256cc783a04ccbca4edd06564f8ec88fe5a15f1e3bb26cec7de5e090313520d98f3
SHA512358d43522fd460eb1511708e4df22ea454a95e5bc3c4841931027b5fa3fb1dda05d496d8ad0a8b9279b99e6be74220fe243db8f08ef49845e9fb35c350ef4b49
-
Filesize
260KB
-
Filesize
144KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.2MB
-
Filesize
1.5MB
-
Filesize
6.0MB
-
Filesize
1.8MB
-
Filesize
108KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
760KB