Analysis
-
max time kernel
73s -
max time network
67s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
-
submitted
28/04/2024, 10:42
General
-
Target
b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.exe
-
Size
5.5MB
-
MD5
89f2d62de50e6167bb21c08b9100081a
-
SHA1
497968e3a60f2b935c68ac7a921dd2ba885f7e3c
-
SHA256
b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a
-
SHA512
8fd290759c3d12d8bb04a337195915a56d32ad48697666816de8726ecbf14effbd6ecd1acb1ec0baf208f509523ccb871abfa2fbf366b61d524a4b63930603d6
-
SSDEEP
98304:skL47FxOCUcKRhz2hPzWJ9onPMkq1rYGvBxjlJDqAST+tDdSm:L4xwjcJhwonPMkCMUjlJDLST+Fr
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 51 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 5 IoCs
-
Modifies registry class 40 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.exe"C:\Users\Admin\AppData\Local\Temp\b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6DUKP.tmp\b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.tmp"C:\Users\Admin\AppData\Local\Temp\is-6DUKP.tmp\b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.tmp" /SL5="$4021C,4613986,863744,C:\Users\Admin\AppData\Local\Temp\b61577bb7256379c1b27c62dfabba0b4ad4aecdccf38071d1df41273f3bdce5a.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\VOVSOFT\Text Edit Plus\text.exe"C:\Program Files (x86)\VOVSOFT\Text Edit Plus\text.exe"3⤵
- Checks BIOS information in registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD576317c324a9a74b8c9ae44c54ce4fef7
SHA1655dadf424369d9cd0e4c8a4abda4b5f1c0b327f
SHA2568c793108af5dd0b36e44ac465fff930ea801ee68f984b1498fbc2e8fb5826c7c
SHA5128f5660d82001e2a21a9fca68f2f0e2847e9fe7ef9ad10f90f0c2dea893321c9ee9dbc42cd14e5594d484f3c982ed86997ab1798ba5d06633117eb1c4d116e79c
-
Filesize
1.1MB
MD5d8ed7d81e54256995fd35d533de59433
SHA10017fa1b1e55bb5ef193cfe9d1df14799e0670b2
SHA256403bca188be2d006b8fc39d267308ebba70c2ba98762d93a8315edcda419708e
SHA512f993bc69a20307ea67b9ab7fe0e51d0a8c4fc332e48fe740fbc4decc2b6137d10c10031b9572a9d1cbe058c21c186f6619e752f47344a0d8bd604481a001bad1
-
Filesize
3KB
MD5aad35cbffa5e1412c09c33d92d7e3bff
SHA17e2d0bc80dac3ce6d500012d1bda4d26ca784b20
SHA2568ae1f19d4840d957728ad90555d5a8dff6cc5c046279c95ff0c00fc0a0136c7b
SHA51237b919ca252992b879df2463a2240ac89833754a258af26150d2ee5df071e0fd6ff3c3a64e921655f25ba75816c4b5b380dc17eb10e6c7b0ceebb0484eabe2ca
-
Filesize
539KB
MD51014117ff4e35330d286847556cb2ff3
SHA1c6444dc3041c4a000306768dca7871fa5de71b42
SHA256869fe17ba4ee4b5401c60a666ee2d6a3dcc237f460b7294435df1cc6a799aa57
SHA512694362e55856542bafa7ce955160d9b370d3dc632729f77ceccb6f3bec1e6e683e61a8eb84486ac7265ec143b6f09aa8a943dbfeacde678869c93397361bc152
-
Filesize
3KB
MD5eaae9bae63b305440b412a48e1653a26
SHA1e22be4b305584c419dbfdad2f69bfa1bb181d239
SHA256c7a8c4d08c29d237880844b1623099f59092602f189be38ce3912e457ff38bc1
SHA512b18126f63bae384cd32786093f462a5dbc906e47a4a3b93c90e394a2282af2a0e3e9a817d0087659dcd951d61f5522cb1a498e208a626fa5738e236a62506406
-
Filesize
841KB
MD54f7da6beac49c854868a454d7d342fca
SHA1395427f8bc434ffe5b1f2cf8105f798970a52031
SHA256bb13c4e70e062f76183151b5359f345b74c295b4ca108cad7a2c2cba18d12349
SHA5126914d5b56ab61df96828c721c83b3830432a1a340682828b873022ddb2b8dd7607facf2ae094f6fbb41f5959a6ab6ed2cce35799c0b39038c49d1191ad6339d4
-
Filesize
432KB
MD586f0d7b28f18ac72a74011b9a25ca8ed
SHA1b26fa8af206ff493d1d5f6e51677dd10e8094661
SHA256e46e4f7682d525f9283de2b254f3cb86d06d24b5d1a91ec5d6c3e5201f161bd5
SHA512f40e38b5b6e5aceb4fe66a7412b80c7745354b15d12e96964ab7652c48e2eae5f63b10903df060a1a4b03682a7b27abef8e90832d97ee90e0306959739773d08
-
Filesize
2KB
MD5c8564b60ec82dbb158799c85667ab601
SHA1f5fd2e6daf03e43149959fa8634332a7f4aab6a9
SHA25611522e2b319b79146d6d4caf677d495bb39a4872f1fbf04db6a8554164f26b53
SHA512cc83982d1fa855ee3ffdf49d1d72a2a84ed154a34800695444d11bb890ba2aff216cc50258ea28953801d38e8a6a6d64e450ac04163d2eb88588948f1ad9fb3d
-
Filesize
133B
MD5ee4327a18206325387778ea15a061baa
SHA150312f8b669920e73fc9962990878a4f3272ebd5
SHA2567602b698d8e14c9f9fb4d90dd21b55302f2b1cefc4b2ce79284427cefa8dbdcf
SHA512581536ec687708ad39d68872d0350b6ddf8ea2aea1b0fe9655b022b92d5c236bb43694c26b597c2b6bc5c9ea4462f5024567c44250fb86c14813f17107d00a21
-
Filesize
9.7MB
MD5a9f7b337354e64d1b6cc5ddcbe062441
SHA1ea94a712e4ebf925a3a8cd20f7a277f7f0e29ce2
SHA2568f62b9d6208b8b149fcc00051cc0851771dbb702c8c1f321ddd48786025d571b
SHA512f9467dc0a6aa3fe88df03622dde5d95a5655a691c548f3de8eb642a86614401914db7863d42895d2e3be85da485dc36dd9431043fe0667144024bcffc93c6e25
-
Filesize
3.1MB
MD59a9cf7db87db4b95f53a552e3e7ee34d
SHA16cec5121067c60df60088a86cb8be29904169115
SHA25668656800e67adfc973b1f0077d3351173a78fd83f72310ae4ebdcfe46dd1fa77
SHA5120234147a8fa9206ebfed19f92a2244ca1fad6ccd5e8a447fa78b9d3d5e7294ccf13eab55b02c9899125b2903040c9c6cab88d1ad1d8bd567ae633ab03c886823
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB