Analysis

  • max time kernel
    141s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    16-03-2024 02:35

General

  • Target

    $R0/Uninstall Lunar Client.exe

  • Size

    404KB

  • MD5

    227c1f9fe7c7f6fb24a451a5ca84e722

  • SHA1

    9c34be548c0b2affd930d05c1b315a5cbe9bca45

  • SHA256

    bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

  • SHA512

    1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66

  • SSDEEP

    3072:Wn77v00hEoDEtauTsqBGeQIfxqxAjDsksbfVl1snhl+l2L0Sa9/l7a4vZAzLmDVH:W740IEa+J+Rql1DKs2t0EyL+ya2

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
          4⤵
          • Enumerates processes with tasklist
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2244
        • C:\Windows\SysWOW64\find.exe
          C:\Windows\System32\find.exe "Lunar Client.exe"
          4⤵
            PID:2716
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://lunarclient.com/uninstaller/?installId=unknown
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2480
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e242880b58667450d3eb257e70549ca5

      SHA1

      31eb86e3287cbe8b51061bd51d03c0657d1a6bd6

      SHA256

      f39960428f9b87f1fc910285c3999c404918129e7bce90f9de9e2d36a659517b

      SHA512

      b40cc8ad54b50a2e3b4575024a67b3883436f1ff14016a73536d9cd6e70e4125bd5bfa39350d5a27db65fcc151cba027d9ab050e195589b4296b9b7a6ec10d89

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      0bbceae0965b9413a70fa98a13a3d14f

      SHA1

      e3e811f981edfab923c2c174752f6f37b5ad7c32

      SHA256

      8174b82a1fb5d3424e9a9a69c2d1b2267c6aaf0b495f4407d53c3dc7e6e1111e

      SHA512

      b9c5935a73468da99cc6ee228b70d5fd8158591a0061169a27787e85488d9a4c1c53901e8e61d9695c974f17f880a426e4eefd2e31b543f29a2f21965998880f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      3f8fec821200b7f0278e3743e5fafdea

      SHA1

      1f403773a5026416a0e46f824268f647bceee2de

      SHA256

      777222d5be73f065c34d38e384ae618affebcd2c98c06ec902513fbf01b99b26

      SHA512

      1c620916e84ab829ba610ebb0ad1ec71bab1a95b092f57afd881547b56e44543434bb5b4db734a0d97f39284f38de640de2586638a6878a938f72a5161afe6e6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      2db2b7f59fc100c1364c95ac593d80e0

      SHA1

      65974ab2c8a42b8c599f0fa3385bee30feb14eac

      SHA256

      66f0139482dd218792d5f63b7bc501558a1f42e10d79d0c0723d636a045ac4a2

      SHA512

      4d4ed4a5f6e3f9830a373918673f6e92d2a01e049b48b3692567081a97bb86b1684bf0ad4d8c34b1784019222a25ca4eb4010a00022c605d0e02506f66f57c5c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d0e0af5ba1393b201ddb85f09d582b0f

      SHA1

      bf7ad1e6fdd206d3e459af143eadf31e0f497141

      SHA256

      fc81d1c0caf26b6e434086893ff2966eba5cac8a994bce4994f33ae1201639ca

      SHA512

      f25506be8c0cc8e457c8711aca54e2d8283cbc619990384ec3e63d4431bb1182ce6256d76425aa20f1ad5e6dee4bed6c7c937b442b4003ed7344e43dc7c48e83

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      58f4996f1f61365d65e67057758d24ab

      SHA1

      4a8af8c4da50dca651441616f28b50b497aafaed

      SHA256

      7fe2fd0aec0d7c548b3a8ce8c5121eee76f95047edb9f72414d9d498d07d543d

      SHA512

      8e4089791560204af9b154f0533340b6dc94b54e8d4d74b0a9a38d1942cc212b215cfa2687eaf46e050aacf328f2d094f9ae8b36df71100b23d473d33a77d333

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5db53cc870b0f00e4fc4f62a69fe421d

      SHA1

      09ae9e0194d7bcb3f884d92f0a882e9904ad83b5

      SHA256

      6d51283b3bbeb4ee05b350353280f03c7a442146d16121492059abc6a113a3de

      SHA512

      9386c82325a5ab24cbdeb1e696692bcfb300de2409fbd8864748f0a351e157baa14c25b7b1a608be0a13423ec8cfd80f287c5d87e0b4635c1e42d78001dd3340

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b3c294fd7d6636018c936f4dda42e017

      SHA1

      eddc5b4efd68f9fa292909b45d536b6ca0ad9b0f

      SHA256

      ab7418e7627d11598f66246369cdaea7e9130dc42af327d12672534777a2abfa

      SHA512

      5ee367ddd3d7813526dbd39db627a61557acdf3ddaa086b4fd95ca54dd3e687dd56c7010112f82ee702b46dcb0aaa9552b2ce97da8512fa9d639569fbefd3d5a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1134eb9775c06b59b5cdff9b5bdfe5c7

      SHA1

      796e108da3087fcbea44316a87ba56a4f891d5c6

      SHA256

      4adca7543883dc799afa0c094f5a2fcae75e9d02881025f406f2fc4ade0199f6

      SHA512

      7b55354b2fba2492043acbb141b3029130a90e59837fa03289d0a87f24d738c325059449d81afcf32d94e343b7e9627341c74fc88387a470646c18b08e0cc53e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5ab9ea65cad80845df7346cf5769b8f5

      SHA1

      9d31de58f2783681f3c908c71aa896627d018d57

      SHA256

      9e8d96919ef491fe4c064756b961943b6a55393012a6fa446f19077d39abe22c

      SHA512

      feaeb54cf236eb1cf0e994e2b60b14a9165830f980c6d3d3669fa376e54dc0a35ec25979fb10134989a5de683b1b78afb99072c8d6019667217e744020ba949d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      30b9cc2344de7d382eedbd2916f559de

      SHA1

      c6d8d33d8f5a89cfbb88da49d571328aaef750b7

      SHA256

      73a6f093c9e5e7d9547bf326dc04a77afc8cf820d66cb84d40410811413eaa6d

      SHA512

      9d1932456a389fd16b7a0d4a0b4a98a9ee32ed8a767b2289dc9777a82169c47449ebfab8cbb15e1a259d9821aa5ceaa2ea9ea7769b5a879b3c094cf98dd744b4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f105e8d795c8bb5d4f1adcfaaa880882

      SHA1

      4baebf5102676f45df8cbcc43ef2e6153ec8b244

      SHA256

      2bea3d42d1c679aa3e0c73751307cbe34298ea9c9a956b88a442c28066c4b3d8

      SHA512

      c59e9f316ab4623ac000703eb93002834b4b9c7a97c09a566c75edfbf03f4d9f87cda8fd7b0a1b081bc65371a1d2c1e0ff12298b658bda7dea86fcc82173cf4c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7121e5864f68f7137923b102866a2e0b

      SHA1

      0febb2ac28fccd17554d3518aaae36596f21a5b3

      SHA256

      dde70ca93a0fc642c4f05ac6ef18011ce06afae13728c517f098d92dcb42d1c8

      SHA512

      f6524d4cc513ba3d0700adf6d90dcd31ce6451efe48804cf2f2c6a86da1c8873d690cc4cac094fea37fc3c882235e66aad0acdc2f192717c4e9975d393d8df5f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fa4afaa8169afa55486432831f68fa68

      SHA1

      7a742c96e3b70cca90f5cd9230191ca7db103f62

      SHA256

      f96c17680bf83cdf10a0f0a5a59c0425cd5b8b9e53c706602b70ec3e3d7d44ee

      SHA512

      5eb724c265a15ffe55ce4009de7625f9c59aee5950ceee13cac72589115e1baa9cd16f2be264983a1b47e1a0ab72661fcad7507faf3a92b9e30d9177e273e390

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fea852c2cce0329fdcbc24223859b31e

      SHA1

      02bacb8adab0f9863f9692bfa61ddf79d52c304f

      SHA256

      8e42d4929d4a1fbb28812b9744d2cc8bc7188a29bf1b21b9c0d201ca0ab8b943

      SHA512

      1194a28a5baabbc0cd811dfd5294669af5a8c0b89587c689683c7c46674bb61b505f74c4b17ec0a852a0d56bdab6edaec50a1c15fa168ea9957b26b4268e2cb7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      694ecb441d91c673b519edf3fea4601a

      SHA1

      b79c7fc8028b8b8ee0560615c517a4490a03fd56

      SHA256

      982f9909870dea0ba92beda78882e3a5a0e83bd5860356e80c45382e99d8810e

      SHA512

      67cc4e7c329604a99d1b7393c409653dae5f737a11f3ff971a64915ee7d8afa78bf267fbe0cc95ad243e6f2e71248299c116ca2538c551a329bf446ac3ed42fa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f45c1dcec7a258e10b6c97e5e9e5c780

      SHA1

      bfdb336bfdf2a8d395b1647a3a062181ecf5d6cf

      SHA256

      90a0f46dae1ec38d10cbb645e4073f5f916750653195dcd2702e19dd94e66af5

      SHA512

      7b085b1dec46a556b21edf3a64d1dca75919d0250c87c82d636d70f7e2156b44225ed3ab7996b9509e57941682be124c77a00608dd0a0d87c87647aa65afb80e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f32d9db0e6c15832e1c90ccceb054524

      SHA1

      05dfdd95d794a7b98655e65b8f1712773e77ff5b

      SHA256

      d22535d18d788de3e7a1c5a74a7df6e0fc712766dc1eda5d72d72e541ddddd02

      SHA512

      d3145fb16aae2aae054ff8703550fc8a70a123f96606df7234b59cbec9887e882a864e3f56c462f12144d6abb92915a12f079e762acbe123f18149ff3408b3c0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      7579a3597816a326fb922498a61ac73a

      SHA1

      fe4c5a96af6e3d044476d4ec35146346af5f8c08

      SHA256

      db9756e9e350fa0ae6b13b189a9d241713766415c66092eac49d453a65567156

      SHA512

      001bd09f8d8c0ef072d4df7b1ca1cc7eeac93a91337ff8cd7bcf124628763a1ab31d13604e7c3b3c10c9ad08a3d38dd0bea2b92c94a2b3c3e31aa8acd2b540db

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d04927ec7909998bd7b91b08a13b3b5f

      SHA1

      4fc66565033b112b879431f06f0ac5641b5ffee5

      SHA256

      8221255daf1632e00d2eff4af783c89194b3d404436a4ba5cef240ae4099f41e

      SHA512

      a0d239b1e8612f18adfd6bd5bfb9b9b14df485ac6cd7250c2305711a93ab19da14d8f33bcb770de5f65b89a565b31673dc2d38406b0dcbf7c89c4f71da6b6b88

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      fa7c37d73d5c418c940f50ac52e3cb0b

      SHA1

      1ad3d916b14834d9b4413b0fd79e927642bbc6f0

      SHA256

      4c237195662c94e60dc8b68a20275f85619f88d424b6292dc02885b05143ebac

      SHA512

      8dfe4005e805a7771edce1aa0aa6771ad32dc841a1162a1c34bd5140b304d58457a7ab7956b1d66228776a9e05d07e504c88783a0dcf35c15ceaf87c8a7b0650

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5161c410b5caac9b758d24fb54f49027

      SHA1

      75f2b2fe975f3141907a0f22e1b2d555aad059d6

      SHA256

      f2aef78ad33fac6387b740f86ed0112b16957387892b67984989f0c73972aeee

      SHA512

      cc13819fc7ed07332572677a0bdea08f13bde7edb71c7131719318934cbd3ddd804fffc2a22b18340dce3df1a183391e1033c4791156dc2b89a78245ec211d72

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      74eead52fc9f36a2627aad7d6fd94892

      SHA1

      755f9a1219a6a5845f8a3ea5ba029f98cc31c91b

      SHA256

      36f432be5d43fa462920042a8fa06d28e7458c5cb516bf3276e8602704776bd2

      SHA512

      8edf1d80a25eca6439ac9ccf48f0e808d77eb30ec1a95349085508f8e62f8e875af8b3fb3f664801efe668a14d74fcb7657503453731b8d67f9a0970e19cdc64

    • C:\Users\Admin\AppData\Local\Temp\Cab2D68.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar2EB7.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • \Users\Admin\AppData\Local\Temp\nsyC9F.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • \Users\Admin\AppData\Local\Temp\nsyC9F.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • \Users\Admin\AppData\Local\Temp\nsyC9F.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • \Users\Admin\AppData\Local\Temp\nsyC9F.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • \Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      Filesize

      404KB

      MD5

      227c1f9fe7c7f6fb24a451a5ca84e722

      SHA1

      9c34be548c0b2affd930d05c1b315a5cbe9bca45

      SHA256

      bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

      SHA512

      1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66