Analysis
-
max time kernel
144s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
01/02/2024, 01:27
General
-
Target
Docx 90273030 PDF KADNlehp.exe
-
Size
142.2MB
-
MD5
0b8b8a28d85984ea421e78f312a263b7
-
SHA1
7390af01335044dbc7ba92ffb2737c525aeaa7e5
-
SHA256
d3ea673dbf254d2fc268be67de969033983a375582f4a385d1600a359a1d451c
-
SHA512
9128e36ee055bd05a635d590f82b03087c06f98b3fa30a2cbf18feca8d318a5d6a8ae9f0b4b842ae743eb804b7f8f0476da0c0a53102eabafca65b017051e1de
-
SSDEEP
49152:vzfYgT8f3q16SrNSZFNiNh1NxPYHgQcRWqmjYE/bYy38zAfdqRnNFF:vzfYdf3xsh1Nx8cRWqmjYE/URN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Docx 90273030 PDF KADNlehp.exe"C:\Users\Admin\AppData\Local\Temp\Docx 90273030 PDF KADNlehp.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\FastDriverFinderzfxifTotalDriverScan\DriverUpdaterProslsbgDriverManagementExpert.exe"C:\ProgramData\FastDriverFinderzfxifTotalDriverScan\DriverUpdaterProslsbgDriverManagementExpert.exe"2⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.7MB
MD5726e5d5a15976b9902cf1e4c30f39c68
SHA11272689fb1a97372ddcd36028a4afd0175907f43
SHA256f2f96ed059da38e98909767adce115b3a2ab7b5817d4ca84575c1c47a7ef74f2
SHA5125e7e03754d75c6e6008a2e22c27179216d4b8071fb33932e8d56ec504ba562dbd24a9890f651bd5ca46f55ae615f46468a5a5ce739c4d5acc19ad6cfd7f530e0
-
Filesize
1.4MB
MD5389983258db02a3f0c95de15d13f7bea
SHA177753cd06a357367300897118e703924a3e76e40
SHA256a457ac72dbfdb220155eecde1773c9a20618b9ebc5222159298a15ebb7d06582
SHA512429a55ae2454cf0230e7e2b568b06bb6a0bb3e44e9b9982fbce40e47b0e8e227de14b96bfa52ad33d0881fd01cd049422c0e5e14ce08c579618a17ea42d330f8
-
Filesize
1.3MB
MD5d50afa24ed18cde00ca7552b90291644
SHA1ffa5546f08fca79eecd8ed935c49bf032c81d69e
SHA25615f0460bc19872458574877e1010b1549407ac94fb9633860efdd692dfc71db5
SHA512b114506656cd740968621780e7142a8caec1a84cbd49bfc58c62853b817055a401fbeb011f31a594707860bede9747f2e76bd6f67701d1309b99e09821285141
-
Filesize
1KB
MD52172c8167f66b2185af50b2ffb8dbcb5
SHA137a1b4d57d5646df4b8d5358d3e62d9631c943f5
SHA256bc78ed8fa6c3b965989174b194256de36e3a0a9c38596cc114e09a0e8539132c
SHA5128eacbe3dd6145d1ab36e4a4617b18a7bf151a00cda8841f67250a52299250e10a57c3178d1aeb333eed6d84a3e4f9e34592d62fa928aef8284341139c561337d
-
Filesize
1.7MB
MD576208f012f4b9878d59fdde94397a4fd
SHA1ff630279419bcf64cfd367d2489113dd2bb52545
SHA25627b1cd742a1359fb16612fe3233d49ac3023528073b09fbcd77245c003690ed7
SHA5121a289a07c485ba9b65a61861cf469ad603b87ce7ba2a87d03a76a90e6e6ebf3c0abce1c065fd31f3c0b04cc8acabad18b6dacb682e0c874c099343ae06b000a3
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB
-
Filesize
4KB
-
Filesize
16.0MB
-
Filesize
16.0MB