Resubmissions
09-03-2024 23:39
240309-3nca1seb46 809-03-2024 23:35
240309-3lfknaee9s 809-03-2024 23:31
240309-3hvkeadh98 809-03-2024 23:29
240309-3gspesdh76 8Analysis
-
max time kernel
80s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
09-03-2024 23:39
General
-
Target
paypalmoneygen.exe
-
Size
409KB
-
MD5
aab68536e0cfbb3c3149a02021a09206
-
SHA1
1f2a2e8517d764281b0e076cab5c98c4b9a2cb94
-
SHA256
4364fdf8e6b7b58cbfc34aab3a86368c1c73467ec5d74847b07d72b50a99d3d7
-
SHA512
e622a0797e3455fc213c2078ccc1cc5b769cd09d94d3c4acb140ca87fe607485ac919be83e1d7661199383bee0f3471a5653e6ef9800fde94230b7e3d3311659
-
SSDEEP
12288:wORqrdkTyk4Osir2upORqrdOOsir2upORqrdHOsir2u:jiKJFfr2Pixfr2Pi4fr2
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 28 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\paypalmoneygen.exe"C:\Users\Admin\AppData\Local\Temp\paypalmoneygen.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
137KB
MD5453d2cdee9141c2b68cb1005252cbb38
SHA135a6104146f4dabb3a55b3b6b4adf5a1e50cbe7e
SHA256c9382948f62a4505f5e4b7d9bebae020ecd1e39ea9758175f6c727306d826ec4
SHA51243f9a3f67126d1950f0fde6e98d3171e005a9ef42ed68924cb893ba4ba2dbf8afba9b5c74430524bb6376fce892782667e3b3299a8db470025c7429f52202bf1
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
4KB
-
Filesize
4KB