Analysis
-
max time kernel
95s -
max time network
80s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
-
submitted
21/02/2024, 02:22
General
-
Target
mpv.net-v7.1.1.0-setup.exe
-
Size
30.6MB
-
MD5
33c7108c5866535d48120698ae702a5b
-
SHA1
98aa3eedab62a05f869b20f5dfc3374041f318b8
-
SHA256
11348ce74df3098c2b0e809121f1fb3d13ddd058b637094a5ecc44bc5107e0ca
-
SHA512
455c6bff43bcf57b238c42b69df554c3eedbbaedc82bf239f3cac9664f8d1e6146115dcc16a8b776302938eeb28fb688cb0c1651abfd428c9b59408b67f74712
-
SSDEEP
786432:ajgHjPhlV4cR4g8Rl2NUO49fTn6sUzrkpnGJX48:wsL7V4cYRl2N66sUzrSn6XZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 32 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mpv.net-v7.1.1.0-setup.exe"C:\Users\Admin\AppData\Local\Temp\mpv.net-v7.1.1.0-setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3GVVI.tmp\mpv.net-v7.1.1.0-setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3GVVI.tmp\mpv.net-v7.1.1.0-setup.tmp" /SL5="$301FA,31057434,1047040,C:\Users\Admin\AppData\Local\Temp\mpv.net-v7.1.1.0-setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
410KB
MD5d458d8677a4178445b257ff66985b122
SHA1ce91ff35533eb6537cea4bc66b82b6c116f58e2b
SHA256037a884c0e1313c4e41bbcf5334c99963f07ea2fdf1d0c8bd5476143158e2068
SHA512ef12430bceac412f130ce0d52f3becc9801a4710ef31d94ed57e9cafc3abc2db7ccfd350e2b0d101957e39979596a30cd4a82e95911423545472507a0eede345
-
Filesize
3.2MB
MD50972caaf69c3d2b12f717a183f9f95c6
SHA13da6745d9e236a31311397dbe481f18e58aa31d5
SHA2569549c6e5d461dbcb8e086d8c4aa12b00f1bbe461c3535e4228c359eb183649f7
SHA512886b476b90003c875fad0a42b1724dbdc45fb2e7899ff7ae60034a88b2ed2217151b8c3b370c0b6c266516e5fc4fdb60e43c1c4653d83debc5b3fec19999938f
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
3.3MB