Overview

overview

7

Static

static

3

Expensive-2.0.zip

windows7-x64

1

Expensive-2.0.zip

windows10-2004-x64

1

Expensive-....0.jar

windows7-x64

1

Expensive-....0.jar

windows10-2004-x64

7

Expensive-...0.json

windows7-x64

3

Expensive-...0.json

windows10-2004-x64

3

Expensive-...AL.dll

windows7-x64

1

Expensive-...AL.dll

windows10-2004-x64

1

Expensive-...ll.git

windows7-x64

3

Expensive-...ll.git

windows10-2004-x64

3

Expensive-...l.sha1

windows7-x64

3

Expensive-...l.sha1

windows10-2004-x64

3

Expensive-...32.dll

windows7-x64

1

Expensive-...32.dll

windows10-2004-x64

1

Expensive-...64.dll

windows7-x64

1

Expensive-...64.dll

windows10-2004-x64

1

Expensive-...86.dll

windows7-x64

1

Expensive-...86.dll

windows10-2004-x64

1

Expensive-...fw.dll

windows7-x64

1

Expensive-...fw.dll

windows10-2004-x64

1

Expensive-...ll.git

windows7-x64

3

Expensive-...ll.git

windows10-2004-x64

3

Expensive-...l.sha1

windows7-x64

3

Expensive-...l.sha1

windows10-2004-x64

3

Expensive-...oc.dll

windows7-x64

1

Expensive-...oc.dll

windows10-2004-x64

1

Expensive-...ll.git

windows7-x64

3

Expensive-...ll.git

windows10-2004-x64

3

Expensive-...l.sha1

windows7-x64

3

Expensive-...l.sha1

windows10-2004-x64

3

Expensive-...32.dll

windows7-x64

1

Expensive-...32.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    154s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/11/2023, 10:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Expensive-2.0.zip

  • Size

    76.7MB

  • MD5

    99e9fdcd4cca95086260bfcab9166e05

  • SHA1

    6aa14d299bccce6640cc9ab0ebbe007371dfb7ae

  • SHA256

    565e3abc2f08e6231bb981c366fccfe42796b6ff530bdc66d1aaa5f7e23b05f0

  • SHA512

    2e4bb94709a7d76e07f2b0789d229b2d0a3758ae10d6ba4d2a1cd090354b09b36b94e960c2b4cf8cb5d91eb0ab561d17fbf4640801dd6f2eb475a25b677e396d

  • SSDEEP

    1572864:3fawu0n/faKWSo3JwTAeQyUM7L332Py12Fg4zPFiUUFDv+iB8:hugfdg3Jev5f8y1U7EUiDv+

Score
1/10

Malware Config

Signatures

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Expensive-2.0.zip
    1⤵
      PID:1160
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4220-0-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-2-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-1-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-6-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-8-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-9-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-11-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-12-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-10-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-7-0x0000018DAD250000-0x0000018DAD251000-memory.dmp

      Filesize

      4KB

      Download