Analysis

  • max time kernel
    120s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13-03-2024 00:36

General

  • Target

    $R0/Uninstall Lunar Client.exe

  • Size

    404KB

  • MD5

    227c1f9fe7c7f6fb24a451a5ca84e722

  • SHA1

    9c34be548c0b2affd930d05c1b315a5cbe9bca45

  • SHA256

    bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

  • SHA512

    1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66

  • SSDEEP

    3072:Wn77v00hEoDEtauTsqBGeQIfxqxAjDsksbfVl1snhl+l2L0Sa9/l7a4vZAzLmDVH:W740IEa+J+Rql1DKs2t0EyL+ya2

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2064
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
          4⤵
          • Enumerates processes with tasklist
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2656
        • C:\Windows\SysWOW64\find.exe
          C:\Windows\System32\find.exe "Lunar Client.exe"
          4⤵
            PID:2512
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://lunarclient.com/uninstaller/?installId=unknown
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2484
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e97033d1488da3615a03daa1612f2f03

      SHA1

      e09c69cac05d6dab6ec7130cc1ebac5e083bb977

      SHA256

      b45dd5f3ab4ed2a7a43fbf1927ce4ab6e2efbaadd45ea66bcff74f9dfe42a189

      SHA512

      588c71a262038df5aa57713cbd797f5b55013b6eb2128ba3be7b82a6360df8d0bde3883ebd6e5f2d4e001ddf71593b5e1d7e832703e01dd32d7333cb9d456715

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      aef01ecd2ef96d57e9a5cf8791cbcf12

      SHA1

      4786c9de2e529821a5be6d3f082eba78f2a3340d

      SHA256

      5b582bf082826e184713e96d0bf23491cfc8e94a8c3edd236e14995326d9bb3a

      SHA512

      4bcdc15f9c2f373f3cb4b5df166b76a160b4389a810f915aa9c276e78034db71a10b6ad4a449edec955a4b4db46b49cddea1cbb0077af53bfd2e74040f2a1de4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      682bac34185b110d24b5431fff9b087a

      SHA1

      16e16cd20d783e59d9806ca1419a51d407e7324a

      SHA256

      10b7e48361993129d6a64c77ca98b799ae2c8d7cc138189a29078dc60ea3241c

      SHA512

      3c4536d187e2ea6e68af6fa373c141845a72c850d19e7c659d27ca7422af28f317dc1233ac9277d5fcd16ae6f965269794d9d9433edf1d97226c9528c91f7307

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      34574d0b5bab8f534dbd5d2fda9c7b26

      SHA1

      4ecec45abafe342d23890034b82bc541b89ecc65

      SHA256

      545b50131caaa298162eca945026225dd8918503ccb8827f6c08dbf7e90a4a4c

      SHA512

      fe1aa72a6066f6e07a9d031da776aa20408719d69cb4908fd4df4d3007d9500a53bda1fc29b611c200d6ec61e49078777b6f4739ef2eccc2c50e50e23c9d6bc9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9f603a1a6b2bcf14949326f1d7d634fd

      SHA1

      86991a20cd977cb68a87e0b300769c1c2fb98d3a

      SHA256

      e3bab5c557ab036badd3359fbef83fa989a319a2b08e91d3d4a7b3274c3ca02f

      SHA512

      cfe2830ebf21947f2d1d3c86b7fc563f09c9faacc622b79c767f721dbc8d35d075e0cecd0b769778d5c2ecf6aae9b484f6824cd22520775c09fe8b4abe0bbf07

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3a1f609401d346d6a488ab24299409c8

      SHA1

      4b80c616b5a76d9fbce82c64af9a2eeb1ea31f5b

      SHA256

      8f2fffa0c553cd033a30b4a788f21555e82ab3453741058560da6b268ce585d8

      SHA512

      21c3c4c9b71aa462d400dc680ff79aeaf5721b4003b2795975fe73461f00d3213e72db5b23b77c0a4d93118945abcf3fe328afb943379186aac894de1e01311c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e5d9b9d3e814e50c51f7cfc611a98f53

      SHA1

      81bceac567aab51313c34d9e09ca22875fb4530f

      SHA256

      760af8cbc3dc7ad831f15db736ce0c89dd811a8f9a43eb361d4025a92a75a015

      SHA512

      b0fadcce36fd372ea77d76c72656b02f703d0fe3999a4c8f373e86bb3cfbd2c0674aa5b61892a4aa91524bb7cac9640670299453e840085e8ba6d8f0d98a5ea9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      22846ef61e76e3386cebe53f7673b873

      SHA1

      3e4f0978ddbf640361e3355fe9e73b6486ceecf3

      SHA256

      fb431d09a7946115fb90bceffaa3da01acb074c6a48823dc12cebc72b97bf6f7

      SHA512

      9a4c927e6fe6b0cd6265b228ada70e460a72443abe58e654f10809713108be94c279c2ae9557805ba4bdc6d18694afaf0d26811732a25490226919d2b14970c5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      edce1ad185f8ad07b13d0fcf0d9765a4

      SHA1

      6e59eb4db80515bdfa9351b8e411f7245142f785

      SHA256

      eb9c0d095222bb01b649393544387a8a42785d4beba6b143a6ada69ffee1caef

      SHA512

      1948b80e5f199458b30478622704c037b8ae25ff03b034c1e12e27c9e3ae7d6835e7b9d5adca384f3fc0faae5ed91dcb4150c956e48834866e5a8c83d003f757

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      da7be6a056b13cc692efc7512cb45144

      SHA1

      a7f766feb799fb9a18ef59d52feb735606046ca9

      SHA256

      c96623e1a8910995d7a6be403b8b459ac4a0dcae609578215c6489c8f01f99fd

      SHA512

      d67efb402c01bab56e538c333aec4c026b505ce816fb7ac2f51c92d99b4d8c7b8aa4126e393c58b361132bd1728d8f2c4f615402e53f35abc436b7bfec80ba2a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7d834982636ea4d02b46c7af8a83c087

      SHA1

      adef26a0ec2492ad92fab8f55182ea9e82849cf1

      SHA256

      3d0f0a9ff2567aee4efab2e6b25c804f803212ad5397427c75c55ada3a48b108

      SHA512

      ba8bbefb5feff02f9a7c793b42e1ccbd604ba82c35befc54b23b951998e1042468637301c7f65507d06f46b4f52323113a7c7f8fb2b524f11830214682b6da0e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fa9f11a564b892676b1432e28250dc60

      SHA1

      576ff4ee732e8dff0d129e7b0317e6915b637c2a

      SHA256

      75d6b3c4a82ca960dfa555d35aa8ef2e93e488ffc81421a3414aed4ea4b822aa

      SHA512

      38331e772ad54e96deaad52c6e2d33903e6c8e5d5a1c7ac5ca0ee8b975632e9be773b79554e4de5f59be46936692153d523d720052745d6ff9e2c41b7c7bb44e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3f3ddbdd44bdcdfd3a8e4054bcbefe26

      SHA1

      cb112c04cd671b81f5c76c31fa9d065c4686a8b3

      SHA256

      ef7f9f62e4b095ef293825c5e74ac452f2e8be5f510752af944df1f9b5f1582d

      SHA512

      1ebb647e47b66393ab81628efc2ebadbf1841d4886829b62cab970b1a1e9effdee5e903a1777fc123a85225a744c26f9c3e64c103f7150e8fa248cb2ad60e069

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f81530266c7d76971445a4994e6c4d3f

      SHA1

      25b24630c87bf0f4ebd55176084cc6551cb6623b

      SHA256

      e2a44ef0455a3e3c4d73665fd42d9a4a09c46572141bcaab4502e3093622e72f

      SHA512

      7340dcdf40bc570a363f750d6079402499b54f026fbdd033fda3d2af6f14dd1a34527c64ee3d3d448307ea3a36cd7161fd73474834364d1ac4fd5c747e663f9a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      22680324600f3509633a7adffaf3c332

      SHA1

      c332a90452cd378acd6f423581cfb0abeef4d5f0

      SHA256

      2b9182a4f997bd20dc1e67b0d6fab73075cb5a38f1aa68b61809d15cfe959741

      SHA512

      ae2645add9e366a55a14c8c37bda8d19da1de0eeaf51fe1d845eeecb780bccc4dd6c2fcad796d31e8cab96591d8d74c3ffbb8454afeb5d6d2169a7c9b25a2b9a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      dd7a48ac5798662ad59160d2d96abdc1

      SHA1

      a8c5ad316c33d0fd539052623b5f9ab2b24b4993

      SHA256

      0aa0ba4f607ad6282806214106efb3547bab703f9aee8ea5766c3f03defd8ded

      SHA512

      fd496233d96557ce5d194c69415f0fc93a565c27949be4a2c6c4ea605d740d9539a4486d04996950344148863b32d5ae165996f9ca762f142c1f8a916fe81fe8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d2aed383228142e326ab422b032a84d6

      SHA1

      7545163eb26b19f4ec84308f3d8614d4ad8e8a05

      SHA256

      c8dec462b432e8adaed39b06872925e2338e30b071fee47a7c704ee8bbdf78c8

      SHA512

      8a3840b9138179ab8c6738a384ffd06c5769e42eb0556fed363c8540494a6c433ca1812cd3b4d3ca2e9ad2ce7c062a031832ab9fbce15fe2844425e88b0cf7ff

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e848be5a561b24eb35605c2409b79035

      SHA1

      dff6b60ee64c76348c9f8e048267bf8e1acb5c6e

      SHA256

      822e9cd7c084360187357f0885e65b37fba1710d84913357904cf0e1abbac04c

      SHA512

      313cdad21f37ed4bde836a4dfa6433bf2a839c52cc3614ff190bf0e9caf0164e6d2aaeaadb1a45ff1c9e9ad1cb2dcb843984e17012771d623aaf9c4d0982caeb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ea40d0526f6617f8bdc8624a14b924ab

      SHA1

      f22f2b779632dfbaacf89cedee5fa5acf5e3461f

      SHA256

      071392b357411e11d2e961b56025376ba5db1a9d9140254e74828e70c77a372c

      SHA512

      f9dad5986ceb4ac60fdc851170d809c6573455cdc55de1b573eeb82131d095ee97c2b697b9962cc1ab3504deadc6c6975068c0f3fa3d5240d5e4ddbc0c2f3f94

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2223252a32bb09d715bdab96aeccdac3

      SHA1

      5a3e8aae5bd6c6c9e9fa0b8597004a143005d1b0

      SHA256

      044ac83e87ca6062117f1698893ef72fba07e9dbd827d978b9a7e8ddbb603309

      SHA512

      6a18ca1128edd5f154b870418f400f1753efeb967478e7f1ca7728b1c67274bc26b2c41507d55b4c695eed9a5f4d690a8ea528189d9717f6321a9cb9d08a23c5

    • C:\Users\Admin\AppData\Local\Temp\Cab2BD3.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Cab2CEE.tmp

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\Local\Temp\Tar2D03.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • \Users\Admin\AppData\Local\Temp\nsoC61.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • \Users\Admin\AppData\Local\Temp\nsoC61.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • \Users\Admin\AppData\Local\Temp\nsoC61.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • \Users\Admin\AppData\Local\Temp\nsoC61.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • \Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      Filesize

      404KB

      MD5

      227c1f9fe7c7f6fb24a451a5ca84e722

      SHA1

      9c34be548c0b2affd930d05c1b315a5cbe9bca45

      SHA256

      bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

      SHA512

      1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66