Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
03-08-2024 20:58
Static task
static1
Behavioral task
behavioral1
Sample
5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe
Resource
win10v2004-20240802-en
General
-
Target
5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe
-
Size
730KB
-
MD5
2360bb0b42650f2feb47a0e988ccc3ea
-
SHA1
0712817e7fabe68e34d67ce4151728d9f2eb8cba
-
SHA256
5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3
-
SHA512
d95afaa69795cfa63bed2e22f98bc37eca17402c92a83f062b04b5883ac1cd5be49b6e5653dc8d0e6fb7127e573397ca62f518045795536912526ec4bfd9744d
-
SSDEEP
12288:AcrNS33L10QdrX6O1nbGnBoX0DWdl3oV52aA8buKO01+0SOP1HvMKhv5KVwCaU0F:jNA3R5drX31bFXOul4qr8bK04BOP1Hvb
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2788 jdfjdfgj.sfx.exe 2208 jdfjdfgj.exe 2908 jdfjdfgj.exe 2932 jdfjdfgj.exe -
Loads dropped DLL 7 IoCs
pid Process 2708 cmd.exe 2788 jdfjdfgj.sfx.exe 2788 jdfjdfgj.sfx.exe 2788 jdfjdfgj.sfx.exe 2788 jdfjdfgj.sfx.exe 2208 jdfjdfgj.exe 2208 jdfjdfgj.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2208 set thread context of 2908 2208 jdfjdfgj.exe 34 PID 2208 set thread context of 2932 2208 jdfjdfgj.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdfjdfgj.sfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdfjdfgj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2208 jdfjdfgj.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2708 2388 5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe 30 PID 2388 wrote to memory of 2708 2388 5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe 30 PID 2388 wrote to memory of 2708 2388 5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe 30 PID 2388 wrote to memory of 2708 2388 5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe 30 PID 2708 wrote to memory of 2788 2708 cmd.exe 32 PID 2708 wrote to memory of 2788 2708 cmd.exe 32 PID 2708 wrote to memory of 2788 2708 cmd.exe 32 PID 2708 wrote to memory of 2788 2708 cmd.exe 32 PID 2788 wrote to memory of 2208 2788 jdfjdfgj.sfx.exe 33 PID 2788 wrote to memory of 2208 2788 jdfjdfgj.sfx.exe 33 PID 2788 wrote to memory of 2208 2788 jdfjdfgj.sfx.exe 33 PID 2788 wrote to memory of 2208 2788 jdfjdfgj.sfx.exe 33 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2908 2208 jdfjdfgj.exe 34 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35 PID 2208 wrote to memory of 2932 2208 jdfjdfgj.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe"C:\Users\Admin\AppData\Local\Temp\5156add523f08eb7eabb51f3ce648d6f93c646bec4c6cee7dd59d95e5b50b2b3.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\jystsdf.cmd" "2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\jdfjdfgj.sfx.exejdfjdfgj.sfx.exe -pluklhpfbsnrsyethnymkdesppodtyuhngfszafugyRhvqxsdfHbgnmeG -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exe"C:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exeC:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exe5⤵
- Executes dropped EXE
PID:2908
-
-
C:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exeC:\Users\Admin\AppData\Local\Temp\jdfjdfgj.exe5⤵
- Executes dropped EXE
PID:2932
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
591KB
MD59aa2e1f4bd4d6919c533aec18e0c47e9
SHA162225abcd9442ec735e4a049f5765e514b6be651
SHA2567da2b4bacf0927f5510aee39c8122872f52367dfab528cc77176ee19b70e9fd1
SHA512588ad8b4677f75d319808c167ed1d57a962776d71667f08c0e2373dc153375f2dcf931e0655f1e3fdef1027ba918c742a6b49c06377575ea60a6376e48ffa810
-
Filesize
18KB
MD57e3bf51c4c3a36b47e11430547e25cde
SHA17a0ee686431fa4580341973c3731ebaaf9a1b86a
SHA256ff026f8db90e85004687be818e5f7479292631773cd032d6fdcc69ff7030b3c5
SHA51205052c720ed921cac145672fc037ac85fa53b70ff6093e53156b8bd45d14cec8ccc65428ab09f89dfaba51d8c2961b02e3c9cf9b5f983d88cd2bf04c5f998a1e
-
Filesize
365KB
MD503ac3991dbdb18d73bda731e1f9cdf7c
SHA196ab8e03593bf0591bae31487e89ac6b6e3c3a91
SHA25614294dff13988ad3efe1ef9ca884b98d554a2c94bab76671e8a724d489785059
SHA5121d76a3e1b9e0396bfc9b7a0772c4974161eb215f934cba6e6bc0dddb1c4e67f8e24c68262cadebb591b4ff0743822b001e4afa5d7d3e79cbf2900d3245cbe8a5