99b14ade8ea9c02b24c71a5583d02322594460af4d2fe734ec2af3d6c805f027

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Awesom-O/AOHelpers/Awesom-O Debugger.exe
Size 262KB
Sample240724-hb3bfswbjd
SHA256 7a7addc57ac5c8ff2e781581f0be96d538f9db3dae9f9bf17c73cea9d2d794a3
MD5 f389003bce40296597a843b2bb2c6d6c
SHA1 9c745bf43b6a4fbfa603179be204ad72cd6df712
SHA512 dde086b8d57fadaba9a6e190926ea3a70a5a770134eca331c9a2de94e3a59e444b87d690addd39ec32d1bb61910b14d0823c7ba67e47cea3cca9728b79cc35a4
SSDEEP 6144:DknN4CVUIm6uk06ZLYgvBA+8xmrxgmA+3cclptVopAWmjmZdy:wnNhuBoY8SorxgmA+nlvVlDmZdy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4488-0-0x0000000000400000-0x00000000004A2000-memory.dmp	upx
behavioral2/memory/4488-16-0x0000000000400000-0x00000000004A2000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4488-16-0x0000000000400000-0x00000000004A2000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Awesom-O Debugger.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Awesom-O Debugger.exe
Key created	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Awesom-O Debugger.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe
4488	Awesom-O Debugger.exe

C:\Users\Admin\AppData\Local\Temp\Awesom-O\AOHelpers\Awesom-O Debugger.exe
"C:\Users\Admin\AppData\Local\Temp\Awesom-O\AOHelpers\Awesom-O Debugger.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Debug 06-34-48.log

Path C:\Users\Admin\AppData\Local\Temp\Awesom-O\AOHelpers\Debug 06-34-48.log
Size 368B
SHA256 1d19c87de2167892b2c7663ca71ed17d74076fe71ac01f3ddcc0501d57cd03c8
MD5 e317360ef575fd46b3d97ba18aae535f
SHA1 78729c6fac62833e60427df3a8e2fd9d05a34d92
SHA512 65adb49954749d3eeabb897194e4560e059961cc4d05f8b13a4f6f64e3dbc4aee718e6bc3133d230fb7f4548194190089bae25b427c3085c9824b4a84ed32d77
MD5 SHA1 SHA512

Submit Download

memory/4488-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/4488-16-0x0000000000400000-0x00000000004A2000-memory.dmp