Analysis
-
max time kernel
25s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
21-07-2024 19:41
General
-
Target
LC_setup.exe
-
Size
682KB
-
MD5
43ac96134253208d064ce32624506c26
-
SHA1
ac03df819fe01bfe40dd06d6ed9dd8d4f41c3f1d
-
SHA256
395654e94749287cab9bfceaf4ed94541a1cd9205f0037c813b0c9bb62952092
-
SHA512
559e6c273720fbd410dda7d0b66b0137a8a3e4f39228e5b2485bd1918442ff966c8c547d5b84c7d5f592ab3852c3c6cc07d7e3a93a4d2233b98316948e35c623
-
SSDEEP
12288:qHHrf04eANHQbokS6lJlIG0n/KKK2c3xLP9RXRZLKtbbWHTnKJhuYTCb53fVovU9:OLfuANHQbxBvlN0/KKK2wLP/4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 30 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LC_setup.exe"C:\Users\Admin\AppData\Local\Temp\LC_setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 26123⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5052 -ip 50521⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5e41163c8b23e7e7a5c043473bb020f49
SHA1e8500dbdb29225fe58c183de93f41aaed0dab195
SHA256265b4fa5527f5d85401d3072721a4ac944a128cbdae272c5eee7edc9f1a81b26
SHA512d52950c3b183741daab755f2962af8ad3ca9ce07c837bef47439d013e69d6b325da88b4f2b7b328a4f3bad9123fd6008aca5b79aa91f957bb08732dcc0bc5b8f
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
704KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
584KB
-
Filesize
72KB
-
Filesize
120KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
240KB
-
Filesize
472KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
496KB