Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-05-2024 21:49
General
-
Target
freeram-xp-1.52-installer_i-7TMz1.exe
-
Size
1.7MB
-
MD5
622bc149ee940b9f79512876b92adac0
-
SHA1
f3b6ddd3c9accab0163093179f8bab207aabe304
-
SHA256
ae661e22acd86ec7fd924ccca18c4b73a14b2a0dbb7107cd3bb6bfae0ba25111
-
SHA512
c9691da85197e3eb2de47e61dcf10a8f50b46c9674531574b5a3bda6a4fc59f89e174cf510b4c5efa0d8632f31fc6b1266691929f3273f6fc6dfbbe7e31fc965
-
SSDEEP
24576:C7FUDowAyrTVE3U5F/jOW7zbxL18i1Lz5josOIHIZChhPP7T:CBuZrEUWWnb3/hz50sOyh1P
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 10 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\freeram-xp-1.52-installer_i-7TMz1.exe"C:\Users\Admin\AppData\Local\Temp\freeram-xp-1.52-installer_i-7TMz1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GCODG.tmp\freeram-xp-1.52-installer_i-7TMz1.tmp"C:\Users\Admin\AppData\Local\Temp\is-GCODG.tmp\freeram-xp-1.52-installer_i-7TMz1.tmp" /SL5="$3014E,837551,832512,C:\Users\Admin\AppData\Local\Temp\freeram-xp-1.52-installer_i-7TMz1.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
344B
MD5707712ec79b50fba1cbd56ecffaed667
SHA1076f20d995629e2d295146a28ef6ff3e3ef46f62
SHA2566523629047adf8788939627c83d89ca417923059dbe2be34f7c7d8a9c7564788
SHA5126f6bc49b58dbdfe39d0955796f04d9591059750f65c1b9cc4d916f318de346121779b4c6ac476b85bb1047fec7706bcfc707ced43eab2cf091c91d88223de6f9
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
51KB
MD5aee8e80b35dcb3cf2a5733ba99231560
SHA17bcf9feb3094b7d79d080597b56a18da5144ca7b
SHA25635bbd8f390865173d65ba2f38320a04755541a0783e9f825fdb9862f80d97aa9
SHA512dcd84221571bf809107f7aeaf94bab2f494ea0431b9dadb97feed63074322d1cf0446dbd52429a70186d3ecd631fb409102afcf7e11713e9c1041caacdb8b976
-
Filesize
2KB
MD59250c641035f61dbffb4029cdf965921
SHA1b8c8c1510ee58787e55bcb56084358bc33ba24e5
SHA2567f8853df872977cd3f4174b04fed81a0f9bd8dc08a12986a0d8a3d7261a0747e
SHA512d62886dd135a5555b6ae11bd13a1657a3b8ca1d0045c8c9c6af22f782b11c6ad7b91316456608e5a01c95ded1d4c22676407cb645d90bd32a92aa8607b44387a
-
Filesize
604KB
MD5359f21e970c492efd58a1a8d02afeab7
SHA114a202989710def5041f95de8869cbe1c4d4163e
SHA2567b9322ee889136eb086ee81b6931bd772ca0fc43fcc1236b14720c597b9650ea
SHA51293e1c380d4218182cdf680e6607930b566968dac0d5571c177fe051635ca5268d50f591a57c1aeafbf64167811ed56f07329273ddc01c13c094615130c2d766e
-
Filesize
3.1MB
MD54b9006aeba8a80dc9e86bdefcab1c269
SHA1ed6cffce3062d685893b69da285733ceaa0189fe
SHA2564e5f15b2237f0327360e09a4b52c243e65cc471719470438372480c0e1d61caa
SHA512c01229a448b6c71df6a4097dbc930822a52fb9fb4825d67b8155a283bcf8e15b8e9102fdd6792332a417e0e2e59742246d0435214e00ffc522122c3c26460280
-
Filesize
728KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
3.1MB
