Resubmissions
14-03-2024 07:01
240314-htlfnadc8w 714-03-2024 06:59
240314-hsdpesdc5v 714-03-2024 06:52
240314-hnee6afd65 7Analysis
-
max time kernel
113s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14-03-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Supermarket Simulator 0.1.1.1 to 0.1.2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Supermarket Simulator 0.1.1.1 to 0.1.2.exe
Resource
win10v2004-20240226-en
General
-
Target
Supermarket Simulator 0.1.1.1 to 0.1.2.exe
-
Size
28.9MB
-
MD5
05cf83a49484c1361d211c6e600b6fc5
-
SHA1
e2cec391a25615aad8dddca7d1c743893fc99707
-
SHA256
a89795a9baa1c9e0fff552f3d0ee7d81e9ef3565750462617220b4d86d089cba
-
SHA512
457a8d743aa25ca884599a364ef33d60fa7984c6829da22cf3a302b7be4282d8886246f107ed5d74c5878f8f1444cbe480e14756077cadb3ad1f3225cae7aed1
-
SSDEEP
786432:Pk+fabSzGhsh8ViciYScwzCQFkrixM99NHNxl+XMo:MpSzE4PciL4rsqHNxE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp -
Loads dropped DLL 7 IoCs
pid Process 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp 2276 Supermarket Simulator 0.1.1.1 to 0.1.2.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28 PID 2292 wrote to memory of 2276 2292 Supermarket Simulator 0.1.1.1 to 0.1.2.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Supermarket Simulator 0.1.1.1 to 0.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Supermarket Simulator 0.1.1.1 to 0.1.2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\is-T8352.tmp\Supermarket Simulator 0.1.1.1 to 0.1.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-T8352.tmp\Supermarket Simulator 0.1.1.1 to 0.1.2.tmp" /SL5="$80022,29942592,121344,C:\Users\Admin\AppData\Local\Temp\Supermarket Simulator 0.1.1.1 to 0.1.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD536946ab0740fa086bfc8b8a86260eee9
SHA157e154464dd247f14ec90de065d7be685dcc1293
SHA2569ac13f9bc5564fd8a1eab5f7c945dce1c27940dd63a913108eac64481ddde6af
SHA51251a090119c36f19c8b008d52f1faf76ee1d511e151df777c577cf91da84300a8474d7e17004e3f374434b2d16eb1da3cfaee853e47528f9a1f6fb8bab71ed3e1
-
Filesize
2.1MB
MD59344fe9caf0be0a70f498ef078bd106d
SHA1e5212d2c25367336f86d49b57d2f5d49150021b9
SHA2565d01e5eae3bae33c4f7b86345ed2f5e9724938ecbe90804afce720c5ad631763
SHA512d9c275a82f96fb30d46f4ca487a7a12e133377a796f3999d7d167fcf70aa4059da695944bd888318348a60b87ae8c76d2022a06665b627dbc6a75b0e23ba9426
-
Filesize
30KB
MD5bfca8a245fc3a7fe7a3561aaf687cbba
SHA11b4dd6544baf59632198f6c00e48f741325abcff
SHA256f82e3de7d8d9a400e9d54348909a9ffa64a609d1644161ee40f7ae53c79215ff
SHA51290c924813a59015475717ce7b0271d503a3e3f365f25a62765e16d612c220b29ab7d665575be206758878f4927a420bf186acfc0cad1472ed4c9a12a44fd835c
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
16KB
MD54bafb0739c5fcd96be991f2a3cc9ac2f
SHA19372b03e4515660f732bf6338c4d7e183a78d2ee
SHA2567f74f1c445bf5e9456aae6fae695a8ca60e1d0eb5a2f44ac2cf0239a71f1a8a1
SHA512095946b16020d52beb25b4037775af8bbf6a7f15b56e260a1bf90af5ccadc11cbcb78c80540f087597a2df6bf5d6b2c8358249aed121ef68e96a302a9fb2ec55
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb