Analysis
-
max time kernel
26s -
max time network
28s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
-
submitted
05/07/2024, 22:59
General
-
Target
LimitedZ_v2 Installer.exe
-
Size
24.9MB
-
MD5
3917db1d29da0793fc354d53a1e3dadf
-
SHA1
6d669038e3582e2ff2c29ebff0e572ab50f8fe56
-
SHA256
4089269ac9c71352202e2906f8faf6e675efe9c40c2d78084970a0284c408811
-
SHA512
181be6b58aa44e4ba764ee550945aec7981147edad3551cfcff1d6a6bad7de2eac05a8e9a11a22701233e2f18b13835c7fd5dcc6134bcc7f62d7c1dd5e0d0462
-
SSDEEP
196608:YSilnyM4oz+lgexh7J5M7Lb+lgexhTZtyYH1PaW+lgexhS4e39+lgexhYWnH6TM8:Y9yM+PM3KTTH14heEpnH6fVGQXkq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 18 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LimitedZ_v2 Installer.exe"C:\Users\Admin\AppData\Local\Temp\LimitedZ_v2 Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0T66J.tmp\LimitedZ_v2 Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-0T66J.tmp\LimitedZ_v2 Installer.tmp" /SL5="$702EA,22569339,1145856,C:\Users\Admin\AppData\Local\Temp\LimitedZ_v2 Installer.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Program Files\LVC-Audio\LimitedZ_v2\readme.rtf" /o ""3⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5a07cd7485948e79853ca577f8bf13bd3
SHA1458b49c3cab48d2ef3f63b1d96206b16c4c7531d
SHA256ef4b1bad6f9f9ffe13635a6b0621ed34ad1139025f6f70c4a418a6b6ee721c17
SHA512f0e45bbcd4c1f8470d9f759a21a292387e84edce6332377c031df175ad3ea1861995aed4778ede26bf83be1d6309821389e5abef2cffec752612ef09add2f499
-
Filesize
8KB
MD5db5ee9b4bf6a53b16c65f90219b7aaa9
SHA1281d066352fd64fb2d1ec8a419fb2fcaa2146659
SHA2560a45f531c79920851d84be90207d0fab29e7cef5065621cea2776675a354aa6e
SHA51280446194ff0d6e5569ec4f437a724b555e6f696655353c006763b43718c596e449a10d3440eac0baafab69697bc54e8131b21a3b62f77e36c21573c67a136cba
-
Filesize
3.2MB
MD51efb48db61a603b7b28b6fb7f7766cba
SHA1c1ecf7b8e5a1e00d86185a9948d20a84ab13c70c
SHA2564877c937915c2e7a4bb33b8f1be4116b800be57d744473fbf545d3bcf642e939
SHA512e279f31ba6655c78f2f43d6c31bb6b4e5e6f663938797ab86d59f7103fa39ab14dc8edea4f79156c4def0763fd274b5aaefb8f673af44e3e0fca0805361c89a0
-
Filesize
354B
MD5e0ab66f6e98073eb0634be11bcaa4851
SHA1ce7d9976fc9dd5c6b797eea94d75dfb1ca5a84d5
SHA25665555cbfab9abadc02a00e6766ccfc7eb694e2aca9a4a9c7fb06905c287aab45
SHA5128a4883dec253201ef902ce4c490e4b0436b86b146256b2aa4eb2f6f389058ef5177ed0faac088bfc0dc843057de94a8a6a63d61efa79173ff02f627b5843f64b
-
Filesize
345KB
MD57f0b42d1d6a4d3e646c558185f6711ea
SHA1ef32ba2c56fcb8c6e5a8e7f57985a8be01484524
SHA25652c1afa489ae7bfd893af6cdd9f1af258005703600449e70d338caabcff507e5
SHA5129e50d22b2cb2f241d4f20dbcaccb53034d9eaf5d7a108cc75b635b8f7601c4c6f7f65f90a6b58b789a3114d6fa0071744349bee0f0a9cdb8ecf1d1b5ab48f280
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
728KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB