Analysis
-
max time kernel
23s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
LethalMenuAssistant.exe
Resource
win10v2004-20240426-en
General
-
Target
LethalMenuAssistant.exe
-
Size
43.7MB
-
MD5
cbc432478f11d142cc8064b61277419b
-
SHA1
e87596e97addf45fcecd4289ad2707df0176379b
-
SHA256
8166609f4ba9f7455935c6c8e5c611475e0c353f33e1ce3421cc1be36fc423b9
-
SHA512
629ff3551d25211dce6766778a7f71dffb377e83428db6dd1694d2e18a9839d430e48f611fbb022614984a2090ce0cfba0b2950b0f3ba74837e309387b9c1cfe
-
SSDEEP
49152:JZ3YfIchKUlPM2bq7mTv+iru13ojPJM7q3zskBFHjC2K4IeNcHQ4XwKLHHnq34jI:HeIcBa18Doq33
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation LethalMenuAssistant.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 22 raw.githubusercontent.com 21 raw.githubusercontent.com -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe 1196 LethalMenuAssistant.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1196 LethalMenuAssistant.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\IcyRelic\LethalMenuAssistant_Path_ck2zpv4rabh4tkan4bl20ck321gmsdid\1.0.0.0\0umkvogn.newcfg
Filesize1KB
MD5d9f6bf72e26ab3b83cc7fe2faeaec6ac
SHA158ed797807bf9e6d82ecb91c7ffcce583d4831f3
SHA25694d0ba753a021119808a15091d491e6bb2b9b5fd5086f80dfd71e69f81aa1699
SHA512c3b6ec8af43f27aa879d639f2045a5124036bb9f2fcf568980e8078a6f3935e6d62df6c0a07beebd9231772f6da08f808ba7e15596773cb4ff561b4fdb1fde3f
-
C:\Users\Admin\AppData\Local\IcyRelic\LethalMenuAssistant_Path_ck2zpv4rabh4tkan4bl20ck321gmsdid\1.0.0.0\user.config
Filesize910B
MD5036d1e558ab6be3321193f90c7b69c01
SHA130a4c3a0611735448caa5c139f09a58c0d14ccc5
SHA2565ced48670d059c7fd3d9d78501bd9553c4be699f0e6ae12feda5e727cf93dd46
SHA512b11ecf17b47e0f5fe3cd77703ad947791f767771e86b0539dbfae67c494ede8279cafb60e9af34b178832728c84400b50884719e8a7f4646db0ebf108f813bc1