Analysis

  • max time kernel
    1563s
  • max time network
    1564s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-04-2024 16:50

General

  • Target

    $R0/Uninstall Lunar Client.exe

  • Size

    404KB

  • MD5

    227c1f9fe7c7f6fb24a451a5ca84e722

  • SHA1

    9c34be548c0b2affd930d05c1b315a5cbe9bca45

  • SHA256

    bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

  • SHA512

    1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66

  • SSDEEP

    3072:Wn77v00hEoDEtauTsqBGeQIfxqxAjDsksbfVl1snhl+l2L0Sa9/l7a4vZAzLmDVH:W740IEa+J+Rql1DKs2t0EyL+ya2

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
          4⤵
          • Enumerates processes with tasklist
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2456
        • C:\Windows\SysWOW64\find.exe
          C:\Windows\System32\find.exe "Lunar Client.exe"
          4⤵
            PID:3048
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://lunarclient.com/uninstaller/?installId=unknown
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2380

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      62816ca728cbbe7351c5643c76b2aba2

      SHA1

      5e8512fa89b030b63fde1b7f76a4ae5e69d906d5

      SHA256

      e1b577888fe6ff42d99501e5a0f8fdc83fce4e5f779a543d109878dfa2b2bbb8

      SHA512

      cc41b5c742908cce9820eb21ed98ea7d49a700f7373e4782922d96f29249267bf7125ea61de083c3812e32001758bec64462442ae88ccac6dec846b4481030cc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a0f60a948d9bda78f7cd72222d714ddd

      SHA1

      57ed2a122e05fa1350ccb6244b5f02d220f7b677

      SHA256

      f7de85ab635a91abe40269de43b0e44d21dcffbe7a00b730d7be15221949cd49

      SHA512

      33dd6705aa5dc430d03298890ead3999a0cde6cb8cef99f2c67e258aef6f307974fff373ab0cdb5833adeb9afd8716bb5303756cb03c8ca210c5b6b5bc1b8d8b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      35a0c4205553a0d471cf0922a3fc5773

      SHA1

      2bed667cbb3edaef8a5311aadb3568dcfbb43c07

      SHA256

      db94d6a1eb62311b6e165b00f8c1d7e98e35f7a82e80f843d85078e7aeda3dd7

      SHA512

      c3e9c352add7aed5b26f848ed0205baa9f618796ba8aa26f0ec5bd100abbf5c25348fb35616732a29c96a9973cd2b339f83407778e4a29a0d610f70e7b65cc19

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f3cef2fc8af90bb01c1992c8485aa699

      SHA1

      717d9e9fa411f4af3ade9beaaca5b84511459dda

      SHA256

      e21b8ce82ab22330b78af7501332b947de1107ddcaf6b183e27169102ed48361

      SHA512

      befc202a1374601672d4670c8d0fc7c610ca01a9aea972f75139067f55aa1330de14fb34692eb793db4e4eb2e19d6c63d025c6135aca680375aeb6a0756f0bf7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a231c7d86e49c90559d3e3056e174ac7

      SHA1

      cbf0d8fc7ceaccc57f70c3b0e21d4170c48c4d4e

      SHA256

      451e87c4066167bb1b81fb5e5beee2dbaaccdd4119c6a2f9ded66d682654e9f2

      SHA512

      5fdd21fe31dfc541ac7a23a59c24274e3436c97ac4bf9456111b16c71c2dbac36da69da6e8fa5d0158c015fd30e744aa93c3b6f87dd5a590449d06b50a999567

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e7181d5c57358f6f87f1e764419bdb42

      SHA1

      07ba6e8939d998b8ed15eba051d56bc881971507

      SHA256

      818e3560be9976462d2403303339cb51458c83968f8778b105aece16c9870e65

      SHA512

      40cdd8259d0a44570bbe195daeeeacd4b2a1e7eb4996430d2bcaa4eb26f220165126ed0101bebf54efc6481b66705d65e39a8f229ed4cba121be5870d9b849b5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      4077670c1f855fb4d4b89b8faa34a7d2

      SHA1

      620017a03d23e3e86ff7377d624d8b573bf32b46

      SHA256

      c66f2d0ab136767a108d6aa9ad25c1da54ca1ae4f0f6078bfca12235a86174a2

      SHA512

      051f372a6789f2b6a3e2723c6c4e9aa316569de22c5814088621c6cdab3c3dc760f2a595b7087d7510fe80eb3dfa51c06abba01381745522fb88ac077fed58ed

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      dddfc56053b21b460b4de4429c161c8f

      SHA1

      480ac937de110bbb61982ba2b4e10e290bd069a8

      SHA256

      1653aa2165eeda7201c6120e4655832b0d580f036b756c7a7ed2b3fee9024a7f

      SHA512

      600004615fb135efe7ef78a05092d120faf60c1acf9b98ab94d0b8a50cdb25dd5b0e3ea8e72307a617b184c985a819eafed868402b69c2747e2f7c826ca6c1da

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      287e8d22252bb902770fd5ccfbacfc76

      SHA1

      ede772ce48db609b9b22acaaf1fd3f365e7e8d05

      SHA256

      09661f38a1bfe65c2f398e465e358446f688860d64b1376a305a3fe6776088ce

      SHA512

      df93ecb3fdf1953eda7b8b06fbf9613d29282ef4cf8af443bcdb3c98cebdb1b5045becf60292d71e7a47a95c324649edfa97ffba83058a6768a340b0f9917619

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      9d929594e62d374a2b40cbe026e18e43

      SHA1

      3c8f10dc43aea1e7fef21fcb7b022da95bb2621f

      SHA256

      3556fcd75fbb22339b24bb9cf6870a672aec2d15d802054da9e995631dafc4f8

      SHA512

      6e261361ebfaed43ad9f4b5cbc8b79d17829767efef5b5bb2049707ab79cea2721248937a81253ab38a747622d160a92166d57175db812c81d4ddf38eff34abf

    • C:\Users\Admin\AppData\Local\Temp\Cab431A.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar507A.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • \Users\Admin\AppData\Local\Temp\nst1F16.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • \Users\Admin\AppData\Local\Temp\nst1F16.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • \Users\Admin\AppData\Local\Temp\nst1F16.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • \Users\Admin\AppData\Local\Temp\nst1F16.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57

    • \Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      Filesize

      404KB

      MD5

      227c1f9fe7c7f6fb24a451a5ca84e722

      SHA1

      9c34be548c0b2affd930d05c1b315a5cbe9bca45

      SHA256

      bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

      SHA512

      1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66