Analysis
-
max time kernel
146s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
22-07-2024 14:28
General
-
Target
SheetRat/Server-cleaned.exe
-
Size
1.3MB
-
MD5
c1862c57cf6b6c302f71ef986950328f
-
SHA1
2b5df84beb75f758e2b50f9d8c1d73cc59bf9936
-
SHA256
f90bcd094d81b324edfa8413b4ae9a6a51a38058520b2572151a91205e9b788f
-
SHA512
de5cd2be9933e317d48b2b8556a260a5427ca88e8653975951d9d6364cebea91e3cc500a724a7d38c314d449c84ba9cb12988f3d2425905e149f1a095f90ef2d
-
SSDEEP
24576:YLysNT+f7momlEkmmsEnE7E7E7EUmemmmmmmIzme4jwnaKEmbToQ2:Y2sNTI7momSkmmtEQQQUmemmmmmmIzm/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 54 IoCs
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 46 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\Clien234t.exe"C:\Users\Admin\Desktop\Clien234t.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD514393eb908e072fa3164597414bb0a75
SHA15e04e084ec44a0b29196d0c21213201240f11ba0
SHA25659b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80
SHA512f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b
-
Filesize
797B
MD51dc25fcc9d2526c8def3bf40c1bfaf69
SHA18ea5d1e6b4f6aba87727fa313d40740071d46bce
SHA25662f5c0be8ea24233cf5660b2d1a0d1f0e7319415f5caf14e7ae84e3c9e2632c4
SHA512845b5f4eeb05d5bb57fd94fdac623d2a3b3ef9365ad4c712667f09912c21ed4d4ef242021124cef40a29fd4ecfb851e8668be854b78dae284a32ecb7e255c970
-
Filesize
920B
MD5db822f44e045c6bce441574f8e8614e6
SHA1e74eb4fc67ddacbf01d66c82a776a04bffc13004
SHA2564984544e2fa632fc296eac6050f8ba3e2f60e585d6be6ef08b49d2bce47a51a5
SHA51280790a1c19b764d07243db826cbf38b224e40cf6be66984141f8d436c5f8be6af2a4be2db81eb2834cc9beb15313474c0f64d694603e1fc6287767b997adc922
-
Filesize
1KB
MD57cf968e0ae06a462ba72a5d7d1fdc88a
SHA195dc2fe0f93f3952e808ca85a2e76b35e06b3878
SHA25687ca18aad1637b36c6e5aaa982110681d1c81e897667b9a38003f3c1052d289f
SHA51249e362871abd1ea9f0ffaaa764b479ed7efaf5e179d87e8f070d0cdebc7bce26f558b1bbe649d837f39d343cb0c4fc6a67cb313f19e4e06c03f4f7f43ad12fd9
-
Filesize
1KB
MD53e83308de9805817d7c747a0773199ab
SHA113bd5f4085f08bdadb67ad22bba2b4d62895d533
SHA256dae07fa593aaa1d8638c277d2e4c936986480528e5fb24bdfbf31971df19b81e
SHA51273643a5f42f2208bc2663b20b5b49aa74c328736c0ac395774d7aa72bad6d760e997c17f5c7d479e611c5ec0c23cb7b74415f9c95fca0973ef3c84c176bdb0f4
-
Filesize
470KB
MD5bd9805b967e4e04d4368ff0644bf4d34
SHA18e3a3c6fd23d5fadb2c8aa8ad8c90d5e6cff2b2a
SHA256d8f17559f481040ff638839edd76bac7ef5b1b6c3ebda476bafeb9709e300811
SHA51245354e8f415fb38b6b226f37b0649411029c0a1fd24b5e72927ee8d18d7ca39bd121125b6d8934bfd338ef0411f6b5696fdf12b218a9a168202fafda7f8ee18f
-
Filesize
463KB
MD5a37b445fbab5ba9da8c800c3f7c3a042
SHA1ac5e59a847e137910dd3e144aeab5613c452a223
SHA256ecb142afcb2bc5d2bc9b0f61cd1b75959ae9e0db988ad27dde3dfd359edc3ea2
SHA5127ac5eb8d9a8a3d77de277a294d8a32e108294b4198396c52e919ef28a03b3dd3986ddf387559a330300b2ea5af44a993fd2ef3003ac7146be367afa65da79f12
-
Filesize
7.2MB
MD5f6d8913637f1d5d2dc846de70ce02dc5
SHA15fc9c6ab334db1f875fbc59a03f5506c478c6c3e
SHA2564e72ca1baee2c7c0f50a42614d101159a9c653a8d6f7498f7bf9d7026c24c187
SHA51221217a0a0eca58fc6058101aa69cf30d5dbe419c21fa7a160f44d8ebbcf5f4011203542c8f400a9bb8ee3826706417f2939c402f605817df597b7ff812b43036
-
Filesize
496KB
-
Filesize
240KB
-
Filesize
7.7MB
-
Filesize
2.9MB
-
Filesize
3.3MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.3MB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
712KB
-
Filesize
1.3MB
-
Filesize
5.6MB
-
Filesize
368KB
-
Filesize
104KB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB