Resubmissions
26-07-2024 05:05
240726-frc1ds1drf 1025-07-2024 07:20
240725-h567hayclf 1024-07-2024 14:30
240724-rvd8ea1akj 1024-07-2024 13:56
240724-q83bqasdqb 1023-07-2024 11:06
240723-m7t26stbmr 10Analysis
-
max time kernel
1026s -
max time network
691s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
24-07-2024 14:30
General
-
Target
Release/Server.exe
-
Size
1.0MB
-
MD5
97fdf675692906714405d7e9bd6a9c61
-
SHA1
f388a87852ca61122f2563b9919625d33c7efe78
-
SHA256
dd3c72966f70692309714ec42461021fef21c26ad33b1b43e3232186b632a44b
-
SHA512
06f371bbec435746a876bb8127979c46fb1a21949c7f2b1f0e7edd4895382c5018113d52cf86485fa8d269f5c4b597c2739519db11b78bb7574638272ebf925c
-
SSDEEP
24576:UcBAVQOcXu65lmmomlEkmmsEnE7E7E7EUmemmmmmmIDmeQaKM:USAVQTXuElmmomSkmmtEQQQUmemmmmmL
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 53 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Release\Server.exe"C:\Users\Admin\AppData\Local\Temp\Release\Server.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\MicrosoftEdge.exe"C:\Users\Admin\Desktop\MicrosoftEdge.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\MicrosoftEdge.exe"C:\Users\Admin\Desktop\MicrosoftEdge.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\MicrosoftEdge.exe"C:\Users\Admin\Desktop\MicrosoftEdge.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Desktop\MicrosoftEdge.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\MicrosoftEdge.exe"C:\Users\Admin\Desktop\MicrosoftEdge.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d2fb266b97caff2086bf0fa74eddb6b2
SHA12f0061ce9c51b5b4fbab76b37fc6a540be7f805d
SHA256b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
SHA512c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
944B
MD56bd369f7c74a28194c991ed1404da30f
SHA10f8e3f8ab822c9374409fe399b6bfe5d68cbd643
SHA256878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
SHA5128fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93
-
Filesize
1.3MB
MD514393eb908e072fa3164597414bb0a75
SHA15e04e084ec44a0b29196d0c21213201240f11ba0
SHA25659b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80
SHA512f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b
-
Filesize
871B
MD5386677f585908a33791517dfc2317f88
SHA12e6853b4560a9ac8a74cdd5c3124a777bc0d874e
SHA2567caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0
SHA512876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9
-
Filesize
688B
MD51b3ada0fdd06f798be1c03cb51b07db6
SHA1da4de6b4d4e3660947059a20e966d01c40d8c2ee
SHA25615f11b3764eca4b990052e1fdfbbb33025baa1455a35e80e5dfef63349ecdf92
SHA512a3d0721cb04eebb677ae80b9738e65aa7c98e9797b08201c548bf1628028a4f3afdb92333703a20ed21cc2fd632733c26524b8d81d9502a7555c9571f3b933d6
-
Filesize
687B
MD5b18785caae8834f89e34cde89b93cafc
SHA1cee194149b484295ddba88111a251986bdc0c7af
SHA256105971bbe15f24f50dad97d466b55222e52dfdb4a71b1b3a6452cfba28a10811
SHA512fb108e2997a0ea7bce21113118997f358d73a43a40e2b4b9962738cd88dc6d9dfc17e17e63c8ba8c5a5504e5775fbe9e8084ee8e6086cf0eab709335ed8b282c
-
Filesize
804B
MD540835a973a8950bec8a0a2a5f40828d0
SHA121dfd15e1fce33b7392dcc1e770fa3c114748c73
SHA256676983bbc395e67ec554e7039469194508cc0c5222f5f316d2cb4b3d9bd8ae16
SHA512324f5a79af6d74abeaafe520e138a1392f016a6a70aa0d9dd37fd8a2458cc4e08c87a24e3cb2f5a9fd250dfd6fa685016d86ff0da576e45aa4de4ffd6d9524f1
-
Filesize
311B
MD5a35bc67d130a4fb76c2c2831cbdddd55
SHA166502423bba03870522e50608212b6ee27ebf4c5
SHA256e94a97e512fbc8ed9f5691d921fdeddbff4cc16b024c5335adf66bff3a7a8192
SHA5124401b234d7914afa860e356be1667cc5f44402255f7cc6cc3d8df80883167f6b55463e62156df57be697ee501897fac61a71f97911c6fdb6630272341ac8a07e
-
Filesize
434B
MD5cfcf8e91857f364e002065c52ff8f91c
SHA18407ecb3c33a1f3fcf18a723e6884acf7e5a0f4a
SHA256572dda8c7f211dc6a4efc7aecb4a54cb4e0ced1e4c9a4b9f96bb329c983c64e6
SHA512364fecac3a051441b4fefcebb2cc9e38632f99dd04593cd5d9b148986afb09b195e88cdbfa2e778b8934564b76d04fe053f919f0a60769b023f2f753ede06d1e
-
Filesize
560B
MD5463d2a6611fbb9f0657b8c8c9783f6e0
SHA19fbda301bda3be3c9c2362b08cf4046857e2612d
SHA25631d89529523e9b788ceec89cb43f1d2d26b44829e720324facf0906251135046
SHA512c2b30090064b389eed8f79429765dc881c74c83352c7bb6e81585b81e9df6010cc89150766e94bf5091279a54b50301a529af70ec2626e2da2a842040424b169
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
607KB
MD5fab682e3478137b228c110cbf18b1d91
SHA1896f7ea6f85b72e3dd1c21fb8d1b2bf7b4b3a487
SHA256ecd6dcd7911ca6660369e6267cf8ef29bba576619ada73ef9566106cb0678e13
SHA5129e4357c01ae9502ede8bc1dec60c23e8f798792bb8e08ff4e5eefd7c33543b5d2c988702b2d35acf67759faae0730573803d5e1fad43fbf61b99d56fb37a44f2
-
Filesize
8KB
-
Filesize
632KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
472KB
-
Filesize
272KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
7.7MB
-
Filesize
304KB
-
Filesize
1.3MB
-
Filesize
136KB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
176KB
-
Filesize
7.7MB
-
Filesize
680KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
2.3MB
-
Filesize
584KB
-
Filesize
368KB
-
Filesize
5.6MB
-
Filesize
1.1MB