Analysis

  • max time kernel
    141s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2024 11:26

General

  • Target

    $R0/Uninstall Lunar Client.exe

  • Size

    404KB

  • MD5

    227c1f9fe7c7f6fb24a451a5ca84e722

  • SHA1

    9c34be548c0b2affd930d05c1b315a5cbe9bca45

  • SHA256

    bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

  • SHA512

    1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66

  • SSDEEP

    3072:Wn77v00hEoDEtauTsqBGeQIfxqxAjDsksbfVl1snhl+l2L0Sa9/l7a4vZAzLmDVH:W740IEa+J+Rql1DKs2t0EyL+ya2

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe
    "C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall Lunar Client.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2984
    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe
      "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2052
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Lunar Client.exe" | %SYSTEMROOT%\System32\find.exe "Lunar Client.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2820
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Lunar Client.exe"
          4⤵
          • Enumerates processes with tasklist
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2664
        • C:\Windows\SysWOW64\find.exe
          C:\Windows\System32\find.exe "Lunar Client.exe"
          4⤵
            PID:2620
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" https://lunarclient.com/uninstaller/?installId=unknown
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2516 CREDAT:275457 /prefetch:2
            4⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:2852

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      252B

      MD5

      47947130b8cb38f1a92b1ced777a3dc1

      SHA1

      06130df076e75ff4c425c9b981885cea04094ee5

      SHA256

      730c6b6f950744feaf7b848ec388d299d62f590f021266ebaccfb3bcaead7bf3

      SHA512

      37bda0434cabc07c3d9d389276c4bfe9f7d753d29fd5b53b5a15dfceec1a1c18e16ca86d16ad6086251bdb2a81e38b49e4bc3c8587d46f22cdf20dd508638e69

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      64e0e3c9a91aa7c2762b0e061377db4f

      SHA1

      e0982d6054af73fbd8e590ec6d7185f70128a2b2

      SHA256

      6046167b8f8de99698b23ccc613f5534f6a03a6608b3f30b6b0c6cd52a754a17

      SHA512

      9a7f5d30d9383a9e1c11e6adac3d123a6f66c22cee63f0b1a24d7c7610c1e3a9de560e75b59d8d9142b5fb3a5d57964cc5cf9fe9b25ef36ce7fe53373d16c12a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a84881edc30d3a13d5bd397f806f10b9

      SHA1

      3612867aedfd098d1eac44e3552d722915f3bc9a

      SHA256

      e592ab16e5f235a0d63621939d88e9de8f0488743cdb8089534747a069fa00cc

      SHA512

      c257ac784a94d731de38e9de464cbe09a33ec5d50ff4a2e80d690594ca511a526443d71e3e6d18e8cfc1958183f51c99d7ca9c2f318f0fe26091163233ce9510

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      3b984dcf3d4a8322e23d75c00144e06a

      SHA1

      3b7426724b80a49ca2b6be172c2fb0d7460038d7

      SHA256

      d490d0da38b49fd3d445889184544d106d7e673e3a285f8a36ece13be34f9ddd

      SHA512

      65048cf32b59e9b4c11fa7b4cc45e406f3803231b642984e5db120c380a5fc1bdd9200111c3ff6175dbf1ad516d3f425396545eb67f1b84342044136bbcc7c13

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      665ba186bd070cf0eb8dc1457128e7dd

      SHA1

      f8a89e4733df3f673adbf2b86f61b1d3d9729b32

      SHA256

      89720edae9af82eba05cf5a88e02736cfbc494c3d90cd9522102df96dbff1772

      SHA512

      96d4f9266e575feff9d8957232c9fce73548dbc1f15f1d5fa0a21d07b8cd35acaf8c7e3ad721b3a8e4aa7fc5fac61e4e9e8c9070513a6e0d9f0613540dea9d43

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      f64efb394aacf5f7993f4a1ea65467b5

      SHA1

      084c2ea7ecdb206b05100c4ba99f886dd9dcee1d

      SHA256

      0b00ff7f1aaa38f6701fd70fee9884d12ba2566942a9e2637661098928a0a113

      SHA512

      22372166b6b868cf99e2a8120695c91dc68b17941f947845eef04e79124e5269e172598e9bf9e66a1afe1bdeacd72d6fc3eeb429d2487d8743c7af80a116f9cd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      7a1491d89f431cb29fa404fab476e49c

      SHA1

      386a49c59dd67cab5e4c99f67596eec85817524f

      SHA256

      b487ff5aee887c919209d45928b47917017a7786a86ad11b5eee5897675c9f58

      SHA512

      afe5ab17d3e869e641ecaec971a0eb529caaed4e88552caf4e5eb39dea00e641b9aa5dd16d5f7075d748ce744daccb3e2b3486bafcffdf19dc9c307cf4dfd1bb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c7ea16d2ab6f31dff6a50ff7193ca6f1

      SHA1

      736a66c4f00ef88450f8d8c4f2a89303f9695fb2

      SHA256

      372a6bd0f6bebe666a0d11ee350f1a45bf34c1632efc66a95fb509acdff30f47

      SHA512

      2ec226ae6021aace6a429045529f94c9d5c2f1c9a176220dcc343e8f163761278dd4afe92eb24549fd185c242c076b165c290acf2599b4632f942d06b86cd01b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      606ac7ed11475d9c3a53ac5a6362c0db

      SHA1

      f3dbb27c2a331a1d8c3cc3ec0c82925c2762ff37

      SHA256

      173daedac77ae99d5ff45c210085b5368c36f8bde362814308887e93f8ad2c68

      SHA512

      bffdb54efe56a996f5a9874e542923e3cd65b0b60f696f3ec482532e315d3d3fac4c9ccd180f07bd2c767f7afb8bc2052fce02ee6b5b8474951881ede354fd88

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      cc987f94216386f7a9b91b5915c80d82

      SHA1

      ffe29d487365893be4ccdfd4645e57c9599561ee

      SHA256

      2eac455ce96cfe5bbc860d2bab1a7e96d62a09206434d2d04509d3de0c0c41b3

      SHA512

      a9606de6f024cceffe49c160c8f29b76f5fdaaa799dddd5607509993b97682ed4155b4a5287ea7ab3f31400b84d515414f616e476b2a27518de5249ef3f53c83

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      a344180a7378e960e2f5316c2c821361

      SHA1

      f301560ed21ee692d983ae5fab4ec529b996fd6a

      SHA256

      2355857d58c1c3120558660c0c0ca2a86b9cbe82579b2ee43ea4d9063ec710ea

      SHA512

      1bd7def9556261d7736824935a58a4fc92cbaa00ff78a214942ae0846d53c61415ff8acb9429f593a620ad971aef41a844152cc2f7d898cb85a6f8f6a67400a2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5408eee868caa39b534bfe7810ae4642

      SHA1

      c96801dfdea1c89f93a5d8975e50ee5077399966

      SHA256

      f0fa775d36242012135bfbffb1874f2ddc439b20f1ac92a7115c266a27f03879

      SHA512

      b075c29b0b0e5f03b6cdc7297182d6845d329dba21a68cd309b4f7ec739bb5606d2611ff4e7e031057a39a8fdc3861e68ff8b4e7737557ef5a1fdfb24d6ce480

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      c41866c1ccac7a47f87797ba6d7bbe87

      SHA1

      aae2f05e5cc485f583b28b8e94e869152c4453f9

      SHA256

      85409b643d58e0833e5760c7d48dcaddef0b54c771e32cd198e2089c43aef206

      SHA512

      deeeaf796867bec64a47d2d3c5011c05acec8a00f29795b9cd0e7a593152709b375b3a081e0e321f2c293cdec3ae67b611409a9d7230b285723c8d8d02d49b08

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      092583379764adab71095dea363f5ac4

      SHA1

      f3f7d1db79290045bd962a9d708cb639f68a5f1f

      SHA256

      80d13bc4b0b7408ab29d91a5c6dc4eaf698560c38b68b045f6425f6438255bd2

      SHA512

      733ac647ec656e436af694fa05d815c78139a5f9cfc9bff957ca632413957200390a75b0dc445507b48217152707c44b60f32358574d64b2d963d713c864136a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      72ca0418f1b56fbcd3d6f3c284309b62

      SHA1

      b112d5056a054ddd7a53df3aa094b4f2e9ddf068

      SHA256

      3cbae9e8dbc1cab5c6caa8ccc31ae04ceda7a8787ce7129d419a8c124e2cb967

      SHA512

      dd2e362c2125a65e31e0048b893f247646a07915b7861d998f141c54034eae8a6491f49e9880867ee73683468a22fbe18204e5459fa28b5efcf0ee39d02899bd

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6e293622e75ccaf92cf09761ec32b76f

      SHA1

      408615f0a00882c9d1cf22228690ade4fde5a29b

      SHA256

      eb186662e0563f2341981f1d25dd6c9aef1f1a1aa2592e6f658e060760d8038c

      SHA512

      2fa390e232b93496a9ebd4fd7bd6609d32275469506850a75f5ddf714679272a82ba65d76496597fb8ea97158f486c1984d853e6634ba683535155fd927461e2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      4e59cd45b446c7f0852ec185b95442e4

      SHA1

      65a1a1601146c9f9346a25d2d5c7fad625391a38

      SHA256

      b62f5404fda6dd3322e3bbda262b78f59fe0fe0bb8adb3a187559326298170c3

      SHA512

      b4203b72ac66117bf93702776f0a02223ca614eec6c4f87fdbe7e1e6f53923ef6d2da5bc9e30d0aeb884b41ee2ba25d5bd28f259f77dd3c32f9e0a55f1035a13

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      5b2de7e92e92b92741a4f777dcd84f25

      SHA1

      98688039550f7771b2989b6757d05d220478285f

      SHA256

      5cf0232e168e6296dafc823756532150f611e7f5bf8c71d92877e3b5a59de122

      SHA512

      6885d33b8635c8fba8175eb3feab81dc6163a59e8967369561454abd37d522eb493f6ffa0a8183aa394e33abf3bd5dbb5e09b2d34c69361655219ae03f3bc541

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      61adad8293e0b95c85c95844c9464106

      SHA1

      980e88aa3c204536086e2f2d4e7acc4a2f1b6c33

      SHA256

      b823ddfe73fc72052f2133821cb8dcc2f05e77f99341a7526bfa2e8ad7dac50f

      SHA512

      d271c7f8a07059d9b546c9fa5ad6c29e952a05662e3a1b06747434d64c3aed7ec5489e947e998fd8192ed62333ccb54c1f1cf939835d47c3d2a99f96f0f07aa6

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      467677386c82577936aedc208fd2f452

      SHA1

      829a2404ae496489a61d841cf8605df50fff9bc9

      SHA256

      a8ff3f304d52d06b225fa4f0ab87f3ede7c35dd96786777571c50a2b00f59429

      SHA512

      e40dc5a6fb534b1552328067e7120a6be1531295ceed34bfe6bf7dae2e813415322867ff0842d20ee943baba33c16cd81caaeb28215f60ca7edcbbeb3ab0aa88

    • C:\Users\Admin\AppData\Local\Temp\Cab4127.tmp

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Local\Temp\Cab4198.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar413A.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Local\Temp\Tar41BE.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe

      Filesize

      404KB

      MD5

      227c1f9fe7c7f6fb24a451a5ca84e722

      SHA1

      9c34be548c0b2affd930d05c1b315a5cbe9bca45

      SHA256

      bafcf2b563e935de1c9d2d55413d25b9a06a8ee8b4cdab49ba7bfe0bfb5c668a

      SHA512

      1fde79719e176eaa9f23211f9679d5406c219b2ae074227306001ea88c3c2f10c1ed1e0e52b10bc1e0ca9adc4cdc82d2da474ce7e59defaae816655ddc0fce66

    • \Users\Admin\AppData\Local\Temp\nst230C.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • \Users\Admin\AppData\Local\Temp\nst230C.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • \Users\Admin\AppData\Local\Temp\nst230C.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • \Users\Admin\AppData\Local\Temp\nst230C.tmp\nsExec.dll

      Filesize

      6KB

      MD5

      ec0504e6b8a11d5aad43b296beeb84b2

      SHA1

      91b5ce085130c8c7194d66b2439ec9e1c206497c

      SHA256

      5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962

      SHA512

      3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57