Analysis

  • max time kernel
    594s
  • max time network
    512s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 01:27

General

  • Target

    AntiDupl.NET-2.3.12_SingleFilePortable.exe

  • Size

    142.7MB

  • MD5

    60c95f17ac23ff2821add307122039f8

  • SHA1

    2a25bfc4c422bda5375c6021e6f218fbe841065f

  • SHA256

    e5f477755a991107b0bb3296639c77c3b4c48934fea8e57ddaee1b7344fc81d2

  • SHA512

    55ad72a658528fd22b53ce81e16b36f2a4d00fdf74841cdb29c96413af88025a3a83b38120383a8a6f4f8c7935039d1714f61fa4f0d4c3186a5af60d85fec8e6

  • SSDEEP

    3145728:2LKLG2tpzxnSZrUTOdyEig+FbgWIgA6ODpVxkXjwf2YcKPTQc+Q9Yk3:2LKi+VSZ68s5gzaktQ1w13

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AntiDupl.NET-2.3.12_SingleFilePortable.exe
    "C:\Users\Admin\AppData\Local\Temp\AntiDupl.NET-2.3.12_SingleFilePortable.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    PID:996
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4400
    • C:\Users\Admin\Desktop\AntiDupl.NET-2.3.12\AntiDupl.NET.WPF.exe
      "C:\Users\Admin\Desktop\AntiDupl.NET-2.3.12\AntiDupl.NET.WPF.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5036

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\.net\AntiDupl.NET.WPF\b7rzS9Bq+_1xvtPmObDdWKCHdnLZBK8=\D3DCompiler_47_cor3.dll

            Filesize

            4.7MB

            MD5

            03a60a6652caf4f49ea5912ce4e1b33c

            SHA1

            a0d949d4af7b1048dc55e39d1d1260a1e0660c4f

            SHA256

            b23e7b820ed5c6ea7dcd77817e2cd79f1cec9561d457172287ee634a8bd658c3

            SHA512

            6711d40d171ea200c92d062226a69f33eb41e9232d74291ef6f0202de73cf4dc54fbdd769104d2bb3e89dc2d81f2f2f3479e4258a5d6a54c545e56b07746b4c4

          • C:\Users\Admin\AppData\Local\Temp\.net\AntiDupl.NET.WPF\b7rzS9Bq+_1xvtPmObDdWKCHdnLZBK8=\PresentationNative_cor3.dll

            Filesize

            1.2MB

            MD5

            ef01a6c206c65369dd05ca5aff258aa2

            SHA1

            219cc335309f7a6b48b3aa0554f228d59cfd0e7c

            SHA256

            6342b0b0c9a864e4dca5d6d6d60d31ff4d7f02232d63fb45958035b5db77980e

            SHA512

            c35f31bcc766a0c1d35a82197226222cfe7eb198a4df8b18acfb174a8654fd2b77e20fe5dad7be7c423e293bbb37d0d0b6a763b2fcd93c3bacd80077a14642ad

          • C:\Users\Admin\AppData\Local\Temp\.net\AntiDupl.NET.WPF\b7rzS9Bq+_1xvtPmObDdWKCHdnLZBK8=\wpfgfx_cor3.dll

            Filesize

            1.9MB

            MD5

            b6ceca7dfded8815e1968d8bd2377ea3

            SHA1

            6dfd0f8bdab3f8ce796a3bc18cf9ac32dd8b8d9e

            SHA256

            09c4b6806b59060339ce6e8fdaf4da145a88179328dedff9534b9483a66566f0

            SHA512

            a6b058494d7e741f36e5ed60e6d9cd49b8f7ceb9bd14f40bf2c02b63355dee74f99c27f75c82e180ef2342287f02e798be99f9bdec879574e78151f0819fc20d

          • C:\Users\Admin\Desktop\AntiDupl.NET-2.3.12\AntiDupl.NET.WPF.dll.config

            Filesize

            184B

            MD5

            13ff21470b63470978e08e4933eb8e56

            SHA1

            3fa7077272c55e85141236d90d302975e3d14b2e

            SHA256

            16286566d54d81c3721f7ecf7f426d965de364e9be2f9e628d7363b684b6fe6a

            SHA512

            56d0e52874744df091ba8421eeda9c37854ece32a826bd251f74b88b6334df69736b8cd97104e6e7b2279ef01d2144fee100392744cc1afb7025ebbad5c307a8

          • C:\Users\Admin\Desktop\AntiDupl.NET-2.3.12\AntiDupl.dll

            Filesize

            16.3MB

            MD5

            7a875118e00a74611399ef4e0d3417ae

            SHA1

            63501ee97796ec9b3e0a6ff720a41bfb51da985f

            SHA256

            60599a2f6e5e863b9f0d66c640a2648ce7b10dc02f5ec220f6d02cb416d5153e

            SHA512

            cf2daefabf1ef79c773596eb3f1091f5139fd4bb61dc54cc862712ba52e281250e97dca991bd04c7f935b3284a8a3cb60d46bcafb60b18ef649608a8f3a7251e

          • memory/5036-267-0x0000017A7C390000-0x0000017A7C410000-memory.dmp

            Filesize

            512KB

          • memory/5036-291-0x0000017A7C120000-0x0000017A7C138000-memory.dmp

            Filesize

            96KB

          • memory/5036-258-0x0000017A7C240000-0x0000017A7C284000-memory.dmp

            Filesize

            272KB

          • memory/5036-264-0x0000017A7E850000-0x0000017A7F092000-memory.dmp

            Filesize

            8.3MB

          • memory/5036-282-0x0000017A5B9C0000-0x0000017A5B9D9000-memory.dmp

            Filesize

            100KB

          • memory/5036-279-0x0000017A5B820000-0x0000017A5B827000-memory.dmp

            Filesize

            28KB

          • memory/5036-276-0x0000017A5B9A0000-0x0000017A5B9B3000-memory.dmp

            Filesize

            76KB

          • memory/5036-273-0x0000017A5B860000-0x0000017A5B865000-memory.dmp

            Filesize

            20KB

          • memory/5036-270-0x0000017A5B850000-0x0000017A5B85D000-memory.dmp

            Filesize

            52KB

          • memory/5036-242-0x0000000180000000-0x0000000180A25000-memory.dmp

            Filesize

            10.1MB

          • memory/5036-285-0x0000017A5B9E0000-0x0000017A5B9F6000-memory.dmp

            Filesize

            88KB

          • memory/5036-261-0x0000017A7C290000-0x0000017A7C2CE000-memory.dmp

            Filesize

            248KB

          • memory/5036-294-0x0000017A7C2D0000-0x0000017A7C2E2000-memory.dmp

            Filesize

            72KB

          • memory/5036-288-0x0000017A7C410000-0x0000017A7C450000-memory.dmp

            Filesize

            256KB

          • memory/5036-252-0x0000017A7C470000-0x0000017A7C698000-memory.dmp

            Filesize

            2.2MB

          • memory/5036-301-0x0000017A7CA20000-0x0000017A7CB1C000-memory.dmp

            Filesize

            1008KB

          • memory/5036-307-0x0000017A7C330000-0x0000017A7C377000-memory.dmp

            Filesize

            284KB

          • memory/5036-304-0x0000017A7C320000-0x0000017A7C328000-memory.dmp

            Filesize

            32KB

          • memory/5036-310-0x0000017A7C8D0000-0x0000017A7C8FA000-memory.dmp

            Filesize

            168KB

          • memory/5036-255-0x0000017A7BFC0000-0x0000017A7C11E000-memory.dmp

            Filesize

            1.4MB

          • memory/5036-249-0x0000017A7D8C0000-0x0000017A7E848000-memory.dmp

            Filesize

            15.5MB

          • memory/5036-245-0x00007FF6767EE000-0x00007FF6767EF000-memory.dmp

            Filesize

            4KB

          • memory/5036-246-0x0000017A7C140000-0x0000017A7C23E000-memory.dmp

            Filesize

            1016KB

          • memory/5036-401-0x00007FF6767EE000-0x00007FF6767EF000-memory.dmp

            Filesize

            4KB