Analysis
-
max time kernel
88s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19-03-2024 03:39
General
-
Target
MegaDownloader_v1.8.exe
-
Size
3.1MB
-
MD5
e88a876515ddca653c424791d614e58e
-
SHA1
4dd7b4bddac0aac4439e0e1582a943628b670e63
-
SHA256
76a56aa46b0102a96a4af355f5e03aff2b6ae6076f040ff4ff4e0d943a75d411
-
SHA512
3d7bc4c0da0216b632551b4520d1b3ab4442175e03db5f4705cbf69ee41d1cf4bdf8ccd275ee40634346f549f16d93d7a98ed929069032fc87a91b8b1c489db8
-
SSDEEP
49152:2qeNVTiHG5hswaJJoUxpyfKV5SiheRiiZQCu9f0BTHgXhfSUQP:nE5iHUPajqCVlwfgJ0ZgXxxQP
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MegaDownloader_v1.8.exe"C:\Users\Admin\AppData\Local\Temp\MegaDownloader_v1.8.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-24588.tmp\MegaDownloader_v1.8.tmp"C:\Users\Admin\AppData\Local\Temp\is-24588.tmp\MegaDownloader_v1.8.tmp" /SL5="$801E0,2536378,780288,C:\Users\Admin\AppData\Local\Temp\MegaDownloader_v1.8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\MegaDownloader\MegaDownloader.exe"C:\Program Files\MegaDownloader\MegaDownloader.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files\MegaDownloader\MegaDownloader.exe"C:\Program Files\MegaDownloader\MegaDownloader.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2220 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5f3b0a05d8683d57861e9a42f451f7349
SHA11eec6fb2649038ae4ec2daa1d7464fa7e7c5ed3a
SHA256388af83e7ab90e23beb0f662c3e08211f63230a7f985e92d4b4d559d8d62b556
SHA512c8385282e269772902db470d12784046a6dd62c067ff6d00874159116d20942bb5d02997874377cb6a1ad24fbd60eb954cb713c30de3efe45ee6db066e57b214
-
Filesize
705KB
MD5c9776dea70af96d8751360d9c629df78
SHA1e1d9f25ef2350385b39a8c5ed54442d1c9c519c2
SHA2568b4af25def34055e6f4aa61b818cbec9a23731781f0cf1fb5c836f62eb9dae5b
SHA512f1dfdd423a567983dde59a86453b08f32d283cb0f9eac7fbf0f4ff4fbb6ecaa0439f2aee09721669557bd1bc86b7751c6bee7bc1c8bf603fa89151763b624694
-
Filesize
50B
MD5370208c6d6b30ae5a8151f11b7ef6cd5
SHA1570dd5fe862a11cd503e8e53e04b4cedbd8fd0b7
SHA2569cd3d82322d8dce11834a4d93d061d9231f8b3ba0e6aea7be86ca4051dea7ba1
SHA512de80689e814fb74abe6a4c49970ff074771b3d16e747b5c98c1bfc6fe8e72122793e496b75602bf4c6b1eaef7ab6a3902bdf1f427027f1c8e1c3c4ad458b9773
-
Filesize
2.5MB
MD596eb39b5d1650daab0a9fde463532dba
SHA14fb2fb85a00120526bac8439209241b00bacb987
SHA256cee4083982feb0e7b78423295621a98ec63df522cf4475e3cc103ab3a95c0896
SHA512780c558be33290fabae820f02c62d0e3a61792a56a06d80a248e9cf12b345f6d1bb45421970305ddb3dd17866b62d600d999c465803f68d0e103182715313fd9
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
496KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4.5MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
152KB
-
Filesize
64KB