Analysis
-
max time kernel
120s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
23-07-2024 22:56
General
-
Target
1abb7eece5f589845b70b427ce6be4f0N.exe
-
Size
377KB
-
MD5
1abb7eece5f589845b70b427ce6be4f0
-
SHA1
fdcf7b665f8ac8b6c457468ed3ad66d316ea636a
-
SHA256
a529926c888fbc85720ba0acdfe3ae0c78ee760e5203726217cdb9288c219944
-
SHA512
1a12e0db904ff3eb6c3d416dae1b996b50d01d2f5807c2e8dafa6e27b3e5ce57bc1d2d783120e768d7f9a7dade55ec2a5b0da1624f7c2a39f4ae45867f700831
-
SSDEEP
6144:r4cne2GYFfQ36/mG0B9Wm44ardkne9WJJp1DK63caI7FcqbyP7UtBdTO3LmoS:r4ceKFfJmGYxAkne9W3f1AGvM8yoS
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1abb7eece5f589845b70b427ce6be4f0N.exe"C:\Users\Admin\AppData\Local\Temp\1abb7eece5f589845b70b427ce6be4f0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\iD06509DfPiM06509\iD06509DfPiM06509.exe"C:\ProgramData\iD06509DfPiM06509\iD06509DfPiM06509.exe" "C:\Users\Admin\AppData\Local\Temp\1abb7eece5f589845b70b427ce6be4f0N.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD57243fdf99760297cdbbdc2b2d5aff905
SHA1cd1ff2ac7a241b3a964e790117240839328a04ad
SHA25624c062ded7ac1572cd269345797499b7e485e608f41469cb0911f4b320e3ff00
SHA5123b8ff363dcfc7f2940287cb072b27f4076dcbf90323011aa1ca6a65dcd935928fb2e660ad75996f8fb65ecba6aa611410d48495c9fdc9e3114d93b6a251d3cad
-
Filesize
377KB
MD58fd566cedbe925ed25a55f745a4c929e
SHA16a9cbde3a6cec9d5d12d41b6ca9ef8c9354d7897
SHA25672456c18bac850b9ddea7a8ba239d7fbc1c96db33f54aab0bf49e7af6342b70d
SHA5122ab8bee08f5139226b364f59e457ee372129a9d505f956fa3642280df84cb058751a80d57740832a44cd182058a72c6bc0b42137724a8bbf357a25d4a0e58839
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
660KB
-
Filesize
332KB