Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
26-07-2024 03:56
General
-
Target
d4e8cb8331e8473a3918ac51534ae8c5ecd9c28534e8bd9c8eb96f76162cf2d0.exe
-
Size
484KB
-
MD5
7a075d0b2c92fd6ba552e818e1ab9c9d
-
SHA1
a2dae3f9b5529e663ac7e43cad281ef550760a6a
-
SHA256
d4e8cb8331e8473a3918ac51534ae8c5ecd9c28534e8bd9c8eb96f76162cf2d0
-
SHA512
f30a1e77eeedfbdf08787f2422afb28a54d195dd429b36c54a6cc62ab7a1b8204010442a84483d65317b0fa10dfffead7a9a1fe8cb605f409b9b7d5da9a269b8
-
SSDEEP
12288:GLPkCDt1EG2XVekhdeTlKKbob6MwE/X+Iwyr:GLPkQ1bqAdxMw+hwY
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\d4e8cb8331e8473a3918ac51534ae8c5ecd9c28534e8bd9c8eb96f76162cf2d0.exe"C:\Users\Admin\AppData\Local\Temp\d4e8cb8331e8473a3918ac51534ae8c5ecd9c28534e8bd9c8eb96f76162cf2d0.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\clictrol\PkgMutou.exe"C:\Users\Admin\AppData\Roaming\clictrol"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~84DF.tmp3432 496136 4980 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2808 -s 6243⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\explware.exeC:\Windows\SysWOW64\explware.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2808 -ip 28081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
484KB
MD52384232b697feb3d190c66e4c338fb77
SHA18dde07a52001344432ec4540e8ee8a5fc3ae0f17
SHA2564da38fe7b3d93d8f15bbd130853f90a1c5eca22750143c5fc36c4ca716a230d3
SHA51257eaeef1a287a7b4791d58da8c80e0296facac5829b7de80d479d821bfb714f750fc930cec51c4ef940cceacc8275ba56acd5551b38fb0884ba5d2a2fc8c1129
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
548KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
548KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
524KB
-
Filesize
24KB