Overview

overview

10

Static

static

10

78f313c6f4...9a.exe

windows7-x64

6

78f313c6f4...9a.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 12:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    78f313c6f45e23738ba0af184cfad17d4593261935f4650f9f3d36421075e39a.exe
  • Size 29.6MB
  • Sample240510-pkth8shd98
  • SHA256 78f313c6f45e23738ba0af184cfad17d4593261935f4650f9f3d36421075e39a
  • MD5 SHA1 SHA512 SSDEEP
Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 3 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78f313c6f45e23738ba0af184cfad17d4593261935f4650f9f3d36421075e39a.exe
    "C:\Users\Admin\AppData\Local\Temp\78f313c6f45e23738ba0af184cfad17d4593261935f4650f9f3d36421075e39a.exe"
    1⤵
    • Enumerates connected drives
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:64
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9EB489BA62673A2FDA7A5B3839CEBFBD C
      2⤵
      • Loads dropped DLL
      PID:5052

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DialogBitmap.bmp
        • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_64\DialogBitmap.bmp
        • Size 152KB
        • SHA256 f7c03fa72a65dd9f9fd2abce0510d75933db3355ada0733f71ecaf7caae74f97
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MSI6767.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI6767.tmp
        • Size 554KB
        • SHA256 bb9a3c8972d89ad03c1dee3e91f03a13aca8d370185ac521b8c48040cc285ef4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ProtonVPN_win_v2.2.1.msi
        • Path C:\Users\Admin\AppData\Local\Temp\{2073965F-C2FC-4F3E-96E4-5DE7DC4B658B}\C4B658B\ProtonVPN_win_v2.2.1.msi
        • Size 19.0MB
        • SHA256 d2e84903464f44fbf0644f3e987dde0becd3d960259712817a012328590a0556
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        decoder.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{2073965F-C2FC-4F3E-96E4-5DE7DC4B658B}\decoder.dll
        • Size 215KB
        • SHA256 a350f06808b517dd2b7f363dca6119c072d08d1677e379ce48267bc7d95f1517
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download