Analysis
-
max time kernel
91s -
max time network
92s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
19/06/2024, 14:22
General
-
Target
Golden Hearts Juice Bar.exe
-
Size
717KB
-
MD5
63cd4e8e3d2a6f0b5ba1bac3df0ff3b3
-
SHA1
a97677c6cd05aa9a78f0158cf8e61c8443741875
-
SHA256
d2592794639164f5c4952b5c73dead881a3282443b6ef362feb91cc1016a7610
-
SHA512
4fbfadd2cae2352a3901858f95fd2f02d5a851c7b79071fab03ae8c3edc8908f5e26ca2dccdff79e47f3eaec446a2f71e7d35460142477f41df782f905699105
-
SSDEEP
12288:2Wvp/4twXq7+7MYczzqWPAz20nMIZ54RitUErly6MYyetvY/AkNCvu4cVYa1cWKr:2WvSwXqi7vcMXnMIH4RxKly6YW0NAjcf
Malware Config
Signatures
-
UPX packed file 43 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Golden Hearts Juice Bar.exe"C:\Users\Admin\AppData\Local\Temp\Golden Hearts Juice Bar.exe"1⤵
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Golden Hearts Juice Bar.exe"C:\Users\Admin\AppData\Local\Temp\Golden Hearts Juice Bar.exe" /_ShowProgress /PrTxt:TG9hZGluZy4uLg==2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
6KB
MD58ca183485dee29adde796f88c1cfc6b4
SHA13a39e320dbec91ab62db7cfb7480588190478d43
SHA256b836bf42c37c528a66249c28bdb3ace496d31d327d4c18dc1ed8fef5ba8e478c
SHA5125a4b4e3bdca68ce9e419c721109ded7e803d9e9818dda62bbe0292071044c5c157c584ab4d108494e28d9196d90da5cc050283c1b9aef059dd331d9b377bc171
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
12KB
MD51fafe60ba8b977d02770aa000558dc52
SHA1d361f5cc22a1ccb0ebf4f148cf110ea94cd1fd25
SHA2565c9e6b81b171156bd877629af354875e39570a4ef9f0ca5b9cd8e452e56111ef
SHA51296cee9afae614753ff7ab640b0e9d41d312fe66f7b3286b4f6c29e57b51aea4bd5645fccb397e6c0755f8ec4daecdb27760f148de2ed649f2d13e1d5cb275abe
-
Filesize
1KB
MD5e091da7c1fadcf939e82069eb87b4677
SHA12461fddc2af7903e43d1a765519912f9c48b656a
SHA256aedf0e41ac2102141e1bc1ede283c28f5f6b1f04ad08805c4e77f808020c52a7
SHA512bcc610f45d57a8d9329d86ade84a56bc33ff6d2fdfcd902cad34f89b1ddb88601cb4a21c268681b5cca35a004f59175f2683b33c1f957c6af862a4750037564b
-
Filesize
1KB
MD55dd27a61c056f030a067972eddeef4f1
SHA105dcc226ec41438e1d5a853ad540cb62a2f87679
SHA25694b76d24c9aa200ed0033d846ac2a255ddd0014c738723582ea3476ee3431905
SHA512f9356b17436388b565f779b5370da03d4c0b8f0b851d734d035b9f5defa4ea8a9e7db7e9d0f204418c2383b37c02fb20a6cea0602e3691c960c4c329248d9610
-
Filesize
1KB
MD50651559d77ec9cbca52a8468e7881d50
SHA17a208b34a99c4c356ba1bff09f17b91846937b21
SHA256e5660264f1fac63d6b62b65041293631516ad8c4921328ed0146d410b883de98
SHA51248726b8c88e42dd5fdf0399c9cca68cb554b749d042ca91c4e2b8f6d55311d5e558d0c4b75458ba66de6f839580236eda2f32b40307609b439df0e61d7b0e6c8
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
2KB
MD55995603e376b72b3f2f02d400b44584a
SHA14127535df235428d157f83006fa23225130215ce
SHA256392d2b22da905e8f2092d96116b6aa3326dbede98fc6f0c45e5b9146f9fc2f48
SHA51274aa387e04e79fab7b6ce570acada3d0cb882f440999f3539caf7bbd9ec505765d9b6b39cea5edfdb176b17186b302f21dcf059dc03ed0045a81595c9947a861
-
Filesize
1KB
MD541e2db8679de78b2a15a5ada20c0228f
SHA14e0cac7678928d838a61bf171c496b922c121f00
SHA256cbd36783ed6c4a4bae2414f76102032fcd0905b911c5596014ed0d14c5685b7a
SHA512aad04e4fd9ff2d90bbee9231b0c095f350393703c3e10351bafc1160896c30d0d3ed5f616bd9820742aed4295a698af392f6106995492bb532d0163d557642b2
-
Filesize
2KB
MD5e3758d529f93fee4807f5ea95fbc1a6c
SHA13a9a1ba234e613e5f808c3ffeda05a10a5dafe00
SHA2568d46eb0c60043dcb7d79ab3d0525148fc901764620c02e4b9c5dd8b0e9026303
SHA512e891552bee3aa10247cad1fcc510331077016a6e71d46827be2dd46017f943c5acc2c1506b41217880d35d52a94989923ad0a345f8791da4bb379eceefe3c407
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
108KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
40KB
-
Filesize
108KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
