da8e72fdd273bc745ce6039e0048beb0958dcb60b16fdd979775e4f013325e0f

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 12:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)/Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)/splash_pro_1_3_3_setup.exe
Size

14.0MB
MD5

4fb3413655b5bcf7719e8dfd78dd65c0
SHA1

aedbc3c8eb5039dbab1aa5a7caa88f8e65959cd1
SHA256

b42593751af1d8a3083903d1a2895ec4d415860e606e5bf1ed4eb0dd2dbb6dd3
SHA512

3b05042370c31ef4def7b80a6f2a2576dfc39b9c2eb7f9d0f58bc2a6e03d8664cf5463883b94047f2aa26703e301fbc27a04e86242a874c5b1d645092d262206
SSDEEP

393216:JipWvimXCGrkcZkcZg1GS0p0V+/g/hLhlHiCx6wF8:fmHwZg1x9s/4Fh5Px6wG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2992	setup.exe

Loads dropped DLL 3 IoCs

pid	Process
2892	splash_pro_1_3_3_setup.exe
2992	setup.exe
2992	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2892	splash_pro_1_3_3_setup.exe
Token: SeBackupPrivilege	2892	splash_pro_1_3_3_setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28
PID 2892 wrote to memory of 2992	2892	splash_pro_1_3_3_setup.exe	28

C:\Users\Admin\AppData\Local\Temp\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\splash_pro_1_3_3_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\Splash.PRO.1.3.3_(www.4DOWNLOADS.ir)\splash_pro_1_3_3_setup.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Mirillis\setup.exe

Filesize
371KB

MD5
a99078b0977ebe046b88ca712953fb81

SHA1
8ae892a693726947e94e19b165ca174bc46c0fba

SHA256
5adef5463393e54b52aba862cdd30951a40b6f122bc10276abe6a6e63f08577a

SHA512
11b8530394015f34156cbac66459543c7bf08bd269b86c8d0fbdc09aaba278ed3c62ca3b5386f2bb47721ee627f90b858c77c66fbe268e62cf1a407a63b413b7

Download Submit
memory/2892-14-0x0000000000400000-0x000000000120E000-memory.dmp

Filesize
14.1MB

Download