Analysis
-
max time kernel
143s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/06/2024, 06:58
General
-
Target
bin/Gajim-Debug.exe
-
Size
373KB
-
MD5
158d64c3ace32c0b737b5b2d1f0facfb
-
SHA1
8ad0a4dc769dd193647f82388399c7938fccf12a
-
SHA256
c3574ccafff8f36c0ea826ae699b2a16ce5af9e83e493a865f045e4bd9c195a3
-
SHA512
d708a8fc2672f9e181fa0a0132ad9dd00747759662a10117e5cada6bbdb6d5e4877fca15f8296b3c274da19c3ccfbecb7bcbd23e61821b31d9dd8f6391549417
-
SSDEEP
6144:KLY6tNR6nMFeqY+gPe8TxMm1D+9gYuHBaez0q5ItWxL+dxLaJDBjmZ88N+ZdbAiY:+tNq8eqY+gPe8TxMmx+9gYuHBLz0aIt9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\Gajim-Debug.exe"C:\Users\Admin\AppData\Local\Temp\bin\Gajim-Debug.exe"1⤵
- Checks computer location settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe"C:\Users\Admin\AppData\Local\Temp\bin\gdbus.exe" _win32_run_session_bus2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78B
MD570505bdcd50ec7ef26c67a7f42c71bfd
SHA1d06a91c17f9986a89fec0e45c75fe7dc808df3cd
SHA256993fe70e51d0b424ae23477d496e032858c3399671a3e987762a02a728f2b8fa
SHA512c546f83476fcfcb4828388e4e73e499e6d6cbc9e38a1602821d9a7d161cb9a35eff5ef6d2bb55e38a7591f1ca68531100c774aa951e9d3ca93a73392a6c27a83
-
Filesize
16B
MD5af781e026830fa4c69dea5b8780ec253
SHA109f9a37add4e54da3a28ab67e99b64cc21f1d515
SHA256d2e3f3f04e2a4a71cc398bbb7bbc1865b5048a48e99f1023e6c50e1368ea9f69
SHA5120ec9ee7cd6713d0933dc7b5e7a17a92e2efd0d136f4afcf5e590473e32b1397b5e49b918b769f0d30fdd77aaa9b3426ae4eaef654088cace8cb9a2122fa761c1
-
Filesize
64KB
-
Filesize
124KB
-
Filesize
96KB
-
Filesize
116KB
-
Filesize
128KB
-
Filesize
2.0MB
-
Filesize
1.3MB
-
Filesize
192KB
-
Filesize
64KB
-
Filesize
96KB
-
Filesize
400KB
-
Filesize
52KB
-
Filesize
148KB
-
Filesize
52KB
-
Filesize
4.0MB
-
Filesize
84KB
-
Filesize
216KB
-
Filesize
176KB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
72KB
-
Filesize
84KB
-
Filesize
180KB
-
Filesize
212KB
-
Filesize
88KB
-
Filesize
268KB
-
Filesize
704KB
-
Filesize
784KB
-
Filesize
348KB
-
Filesize
1.2MB
-
Filesize
68KB
-
Filesize
1.1MB
-
Filesize
412KB
-
Filesize
60KB
-
Filesize
1.7MB
-
Filesize
176KB
-
Filesize
360KB
-
Filesize
1.3MB
-
Filesize
252KB
-
Filesize
76KB
-
Filesize
124KB
-
Filesize
64KB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
168KB
-
Filesize
108KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
188KB
-
Filesize
88KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
404KB
-
Filesize
1.9MB
-
Filesize
56KB
-
Filesize
336KB
-
Filesize
212KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
104KB
-
Filesize
68KB
-
Filesize
60KB
-
Filesize
84KB
-
Filesize
180KB
-
Filesize
7.2MB
-
Filesize
64KB