a6a2098dad8a709da3521c2d50a13f010cbd22571d5d3df0c08ad0ab441866fd

Analysis

max time kernel
149s
max time network
38s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SisterLocation.exe
Size 906.5MB
Sample240608-hd48tsag79
SHA256 c60e1c7994316426d824b82004aa5c76e3aab06d4e78e0c9391628e0d52b2c73
MD5 cc2b5b61426c2593ce050edd44249211
SHA1 4a8ce3c74cef76fd67b3e5ca80eb5bd1b36576cc
SHA512 21ad96969b1e2fd6c09714bbd21389d392fc74b2b49f9c8dd5b166300c98845b2e021bb57cb06a7fe9a2ea0c02091245e9f7c5bbe1fcffe6fb4e61e9167c73e1
SSDEEP 25165824:Q7zWfLoEi71Cimdgsp/r+t/XSAMphd3ieHA9+:6zgLop7cimdgsdr+tQphZAg
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2008	SisterLocation.exe
2008	SisterLocation.exe
2008	SisterLocation.exe
2008	SisterLocation.exe
2008	SisterLocation.exe
2008	SisterLocation.exe
2008	SisterLocation.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2008	SisterLocation.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2008	SisterLocation.exe

C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe
"C:\Users\Admin\AppData\Local\Temp\SisterLocation.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Path C:\Users\Admin\AppData\Roaming\MMFApplications\sl
Size 26B
SHA256 6a67732756457b348a7d46b388b904183a58babc67553a2979427ac4eaa5e17b
MD5 7ac53e04475265a57bec8f38ef696d4e
SHA1 bb05df5fe1047cb027113bd2393cd864177360e9
SHA512 95de2c1a5fdcf1f2ac08566a7bd0f22482b29a4965b8c0eb8dbd2dee0f1ec3c60f8348109803915d79400b1ae7c157ed8b5888c69882b711fc5dd69c8b6aef4c
MD5 SHA1 SHA512

Submit Download

Perspective.mfx

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\Perspective.mfx
Size 15KB
SHA256 090925a4cd961f22b1ecd2fba4ce04ab063e26507a1dc09b1d6a40c4860a8777
MD5 9f064bdcb066daa428db0ed9e33e785d
SHA1 3c0df73cf247ce49d1010fe0e2f722424fe43f4f
SHA512 4a510ce13c379e8cb5ccb9f9c69e28e9440f48156c8c4c1fef6987495cace7c028d45530ac961f47786e8f503f90c54310cb1ccf43d7fd584506461c1bd616d5
SSDEEP 192:ky3C1MfE8YG8vRLkodYlfqbVq1jVF2sLlMUL+Ah1AoEb+py+pIgucW:RGHDkodYOsLlMUL+Ah1ALbI/uc
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcclock.mfx

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\kcclock.mfx
Size 108KB
SHA256 f2319a7359fbcb8860f1c468aad602383c49effb7c110de01ff13acdcf3a5ab9
MD5 991da0ff2087993bba15ed149dd71b04
SHA1 13451a755644095621baefe3a8a9db9c7c550ab1
SHA512 5ee26153f82ac5ae6845b413271942b76a8d7ec50d3e484a7fe1656ee45e34260f73f47fb003b27ce913e6e7216d99a6e8765a431330a76423fedca9db5e85aa
SSDEEP 1536:dxbZlOorghPqU0lfjH4hC0ciB2TjsWjcdcpL1D:VsneHvsB2TMcpL1D
MD5 SHA1 SHA512 SSDEEP

Submit Download

kcini.mfx

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\kcini.mfx
Size 28KB
SHA256 52cdd0d5265dbe45966a787d0082e01ada41553c898f02347840aded98d6332f
MD5 ef2cad7570f3d4cfb8dc7915a92e03af
SHA1 e75063b93d22a45c19b14e93a4030a267faaccab
SHA512 34f202712b3ff0e9bc68c71108f8edd0d61a387a396bfc710af8da26f7d35c0505ba57bfa91ff524c7c43cdc05e09730ca3755e170f65850390fc0a65b8da630
SSDEEP 192:YD16eSCgELGu7FhwhdjMFNGJpjz9tFIwiWTg4x:Y1Hgp7dYFNGJp9wGT
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmf2d3d9.dll

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\mmf2d3d9.dll
Size 1.1MB
SHA256 fce87bf918787de7e8be0419941033dd98285eba51c79cfe16295f06e7b7cbc8
MD5 5e5ffd2560da7af01ad1d49357d0fe96
SHA1 c32ac6a0fca8a662b2e6303f45dc2a0b92848277
SHA512 f51daa8793d640201f1fa428c5c90c77b577188ba774bf2a1a0f418f8463760085e5b1c22cd70672023cbdee9c835633f5973b3c58a806b822721e77bc2a3dfe
SSDEEP 24576:20WIxnHHiaNehdEUXcH/s8vofCHgyQMmhF:6wheh7GjQ5F
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmfs2.dll

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\mmfs2.dll
Size 459KB
SHA256 1cb098cfa35e4692cc2759a1b23100a1f6ccdc6da4dc2bd5abb586e207eeb0e5
MD5 6ab37e080b4cc2466f9039ca42d61c48
SHA1 5fe216adb6867ebfb3bed1eb26da0b48e30822e1
SHA512 c3b5eb68cefbb1756a166751d26d7869617679f27fd95648fa8946bbcac60ea1ed9a3163f2b8081d52285df2fde7e77bea7b0de8e48b5c9ed9c79dc4d514722a
SSDEEP 12288:7FoDewjvfMOLkoAVEz2jeWKaCpzGYRHVfLA2fPTgcoe7:7FoDewjvf6hVEonGzhRHPPTJo
MD5 SHA1 SHA512 SSDEEP

Submit Download

mp3flt.sft

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\mp3flt.sft
Size 24KB
SHA256 cd5bd7cc59eaf42bc0edf418ce6f077f9db369d5e3c414107b82492a877a6176
MD5 7beafd3ec0c36a1422387c43c49f68ff
SHA1 240e7d8534ed25dffb902a969826f4300a88dde6
SHA512 44101803bd757bb7a84577aa1c087472a619da732dcdb3947b683cd7a7df30931e4c9973e06532859f9654c4ad3635db205e41fc7214a0f52537be91e87b2734
SSDEEP 96:24yW7bMnfxKgUEDGDaq5E9my5F3MM+YuU0UNESZpMS07oQCcw95bcPw5IqQ+5lyc:24y+MCQiaOC3j9dJlfMSkI5wPPzElt
MD5 SHA1 SHA512 SSDEEP

Submit Download

waveflt.sft

Path \Users\Admin\AppData\Local\Temp\mrtA479.tmp\waveflt.sft
Size 8KB
SHA256 41136b09b033a20b9acc430620ea095ff76afbdc7aebe7f26f7d2b4315afddef
MD5 f76739536860a0bdb4a7e3bbb0c06d08
SHA1 b21581aa36eda87db8845caf58c668749e26b29f
SHA512 6e65f23a4c1e3b0068b190f9aaaedcfa0466b0185cd6bbafa5f6f6940c8bc332e7c8c611d1b3b63bb2c5fcda48bbe2a678d81a3819940ecc0c701d6fec4194c7
SSDEEP 96:v2or1Jnr+4O1tLj+Ct2KTOGTrgHchhAfETVdnPstJgxl8V6B/8cKH+ewp:vp6Dj9t2ubTVdGJgOMGvw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads