Analysis

  • max time kernel
    23s
  • max time network
    13s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/04/2024, 20:40

General

  • Target

    LethalMenuAssistant.exe

  • Size

    43.7MB

  • MD5

    cbc432478f11d142cc8064b61277419b

  • SHA1

    e87596e97addf45fcecd4289ad2707df0176379b

  • SHA256

    8166609f4ba9f7455935c6c8e5c611475e0c353f33e1ce3421cc1be36fc423b9

  • SHA512

    629ff3551d25211dce6766778a7f71dffb377e83428db6dd1694d2e18a9839d430e48f611fbb022614984a2090ce0cfba0b2950b0f3ba74837e309387b9c1cfe

  • SSDEEP

    49152:JZ3YfIchKUlPM2bq7mTv+iru13ojPJM7q3zskBFHjC2K4IeNcHQ4XwKLHHnq34jI:HeIcBa18Doq33

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LethalMenuAssistant.exe
    "C:\Users\Admin\AppData\Local\Temp\LethalMenuAssistant.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1196

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\IcyRelic\LethalMenuAssistant_Path_ck2zpv4rabh4tkan4bl20ck321gmsdid\1.0.0.0\0umkvogn.newcfg

    Filesize

    1KB

    MD5

    d9f6bf72e26ab3b83cc7fe2faeaec6ac

    SHA1

    58ed797807bf9e6d82ecb91c7ffcce583d4831f3

    SHA256

    94d0ba753a021119808a15091d491e6bb2b9b5fd5086f80dfd71e69f81aa1699

    SHA512

    c3b6ec8af43f27aa879d639f2045a5124036bb9f2fcf568980e8078a6f3935e6d62df6c0a07beebd9231772f6da08f808ba7e15596773cb4ff561b4fdb1fde3f

  • C:\Users\Admin\AppData\Local\IcyRelic\LethalMenuAssistant_Path_ck2zpv4rabh4tkan4bl20ck321gmsdid\1.0.0.0\user.config

    Filesize

    910B

    MD5

    036d1e558ab6be3321193f90c7b69c01

    SHA1

    30a4c3a0611735448caa5c139f09a58c0d14ccc5

    SHA256

    5ced48670d059c7fd3d9d78501bd9553c4be699f0e6ae12feda5e727cf93dd46

    SHA512

    b11ecf17b47e0f5fe3cd77703ad947791f767771e86b0539dbfae67c494ede8279cafb60e9af34b178832728c84400b50884719e8a7f4646db0ebf108f813bc1