12c8a9ab93649f8c75399b6b96f4c54e7454cd0eaa25090dc53c223788c85222

Resubmissions

25/04/2024, 20:51

240425-znevcsef79 3

25/04/2024, 20:47

240425-zla4dsee5x 7

Analysis

max time kernel
1387s
max time network
1182s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 20:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AimmyLauncher.exe
Size

161KB
MD5

1b61edaed8b5543cd875d3d22a219947
SHA1

45d0ded1b50b37063f3a0f328d56f676ccb0e519
SHA256

f9b275cef715b35cd5357b881bf2e62a22a6ea01a46f917cd2c072cdd2b3a18c
SHA512

668b3ee30fa7b2dd4a8e368f8b8eaae387f0641b2f874984e398a11141f520102568520f4fe27b6cd370b0b927f809073f9080092a413086e6f37a06de785a7b
SSDEEP

3072:BKta93TRDiicws0MWbs2OJiKF/ODxT5CyV9u2jNI8m5:B2wX7bJ39uyNJI

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	AimmyLauncher.exe

Executes dropped EXE 1 IoCs

pid	Process
4296	Tn1EOMp5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	Tn1EOMp5.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4296	Tn1EOMp5.exe
4296	Tn1EOMp5.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 4296	2700	AimmyLauncher.exe	86
PID 2700 wrote to memory of 4296	2700	AimmyLauncher.exe	86

C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\Tn1EOMp5.exe
  "C:\Users\Admin\AppData\Local\Temp\Tn1EOMp5.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Tn1EOMp5.exe

Filesize
139KB

MD5
73d2b14229e3d3a77f1b1ab56a027229

SHA1
0c674b5c9648055dd95404d1244d291fb6d3ce21

SHA256
c8a986ab067d256f113938c1a0bdafa5680111b6a976272660e3d6c918d2e063

SHA512
566e3b487a1e95f0e13305f52317ecdbec04a37561633147e7552cbd76c9f3531a8a42849997c67e84e7889e1e5f125e21a851ad71f9538fd9072429868ddc7f

Download Submit
memory/4296-13-0x0000028AF90E0000-0x0000028AF90E1000-memory.dmp

Filesize
4KB

Download
memory/4296-15-0x0000028AF90E0000-0x0000028AF90E1000-memory.dmp

Filesize
4KB

Download
memory/4296-14-0x0000028AF90E0000-0x0000028AF90E1000-memory.dmp

Filesize
4KB

Download