Overview
overview
7Static
static
3MKL_fishin....0.rar
windows7-x64
4MKL_fishin....0.rar
windows10-2004-x64
3FixTOOLLLL...lC.rar
windows7-x64
3FixTOOLLLL...lC.rar
windows10-2004-x64
3Visual-C++...ll.bat
windows7-x64
7Visual-C++...ll.bat
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...64.exe
windows7-x64
7Visual-C++...64.exe
windows10-2004-x64
7Visual-C++...86.exe
windows7-x64
7Visual-C++...86.exe
windows10-2004-x64
7Visual-C++...��.txt
windows7-x64
1Visual-C++...��.txt
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 12:21
Static task
static1
Behavioral task
behavioral1
Sample
MKL_fishingSwitchCity_V3.0.rar
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
MKL_fishingSwitchCity_V3.0.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
FixTOOLLLLLLLLLLLLLLLLLL/FIX/VisualC.rar
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
FixTOOLLLLLLLLLLLLLLLLLL/FIX/VisualC.rar
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
Visual-C++/install_all.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
Visual-C++/install_all.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
Visual-C++/vcredist2005_x64.exe
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
Visual-C++/vcredist2005_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Visual-C++/vcredist2005_x86.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Visual-C++/vcredist2005_x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
Visual-C++/vcredist2008_x64.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Visual-C++/vcredist2008_x64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
Visual-C++/vcredist2008_x86.exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
Visual-C++/vcredist2008_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Visual-C++/vcredist2010_x64.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Visual-C++/vcredist2010_x64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
Visual-C++/vcredist2010_x86.exe
Resource
win7-20240419-en
Behavioral task
behavioral18
Sample
Visual-C++/vcredist2010_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
Visual-C++/vcredist2012_x64.exe
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
Visual-C++/vcredist2012_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Visual-C++/vcredist2012_x86.exe
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
Visual-C++/vcredist2012_x86.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
Visual-C++/vcredist2013_x64.exe
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Visual-C++/vcredist2013_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
Visual-C++/vcredist2013_x86.exe
Resource
win7-20240611-en
Behavioral task
behavioral26
Sample
Visual-C++/vcredist2013_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
Visual-C++/vcredist2015_2017_2019_x64.exe
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Visual-C++/vcredist2015_2017_2019_x64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Visual-C++/vcredist2015_2017_2019_x86.exe
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
Visual-C++/vcredist2015_2017_2019_x86.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
Visual-C++/วิธีติดตั้ง.txt
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Visual-C++/วิธีติดตั้ง.txt
Resource
win10v2004-20240508-en
General
-
Target
MKL_fishingSwitchCity_V3.0.rar
-
Size
109.9MB
-
MD5
a81b6c52892841fda028b7b76bda7b21
-
SHA1
03d9dc7175fbadd96748fe3b8dc1316c7abec426
-
SHA256
6feaf0b5d0a265687c41284286c03b9160833880b77eda231513b3d36b2ab73d
-
SHA512
7633d334cef8ad254fbf8166ea7722415c7878d1bda23e12bb7d3f0446b7548a1c6f0d07ae7f31347ff9044ce11c88aa8983136eada2d1d0529a27d29a734076
-
SSDEEP
3145728:r0K8Dhq59dzN3X8iBE23xoi/mtLEGOuyqNM6C:YKskDzlM2HxoiutLE/uM6C
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
7zFM.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico 7zFM.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid process 2500 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 2500 7zFM.exe Token: 35 2500 7zFM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7zFM.exepid process 2500 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cmd.exedescription pid process target process PID 2784 wrote to memory of 2500 2784 cmd.exe 7zFM.exe PID 2784 wrote to memory of 2500 2784 cmd.exe 7zFM.exe PID 2784 wrote to memory of 2500 2784 cmd.exe 7zFM.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\MKL_fishingSwitchCity_V3.0.rar1⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\MKL_fishingSwitchCity_V3.0.rar"2⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow