Resubmissions

06-08-2024 11:22

240806-ng2vrs1hkf 10

06-08-2024 10:55

240806-m1enxaxdmk 7

06-08-2024 10:51

240806-mxymls1eje 3

06-08-2024 10:49

240806-mw4r8sxcnj 10

Analysis

  • max time kernel
    109s
  • max time network
    112s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06-08-2024 10:55

General

  • Target

    Setup.exe

  • Size

    1.1MB

  • MD5

    c047ae13fc1e25bc494b17ca10aa179e

  • SHA1

    e293c7815c0eb8fbc44d60a3e9b27bd91b44b522

  • SHA256

    6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf

  • SHA512

    0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c

  • SSDEEP

    12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Roaming\Httpta\JFRSJPMPUYHQWSNW\StrCmp.exe
      C:\Users\Admin\AppData\Roaming\Httpta\JFRSJPMPUYHQWSNW\StrCmp.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1096
    • C:\Windows\SysWOW64\more.com
      C:\Windows\SysWOW64\more.com
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Users\Admin\AppData\Local\Temp\Encounter.pif
        C:\Users\Admin\AppData\Local\Temp\Encounter.pif
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Encounter.pif

    Filesize

    29KB

    MD5

    d0509de5ba78cdfb67f897b06d9d184d

    SHA1

    f3ea9fa41831739d38353167754c0bb5a9544001

    SHA256

    a5a7183977808efbaa1ca3e55776f09bcae8f30e2aa5b0520c9cd88cd0d4997d

    SHA512

    0cdfb02946e8450a057db69f3e4331adc2b1bffee2d6002ea2a1ba8b9964883dd71c6f5becd41c02a4a06fd84e20836348b56af3696ae21587a774ec75d9f2c5

  • C:\Users\Admin\AppData\Local\Temp\d106f19a

    Filesize

    1.2MB

    MD5

    e6632614501deb736e6daad6c59a8546

    SHA1

    ffd450c0c6194d3cf2831fd0db37a3779254b2ff

    SHA256

    ce9ae752abdbb0b27baa3c8b65e3ca332cb4652d96e62da2899c85efc9949183

    SHA512

    0fb6e72fdf433950acc587f44c2e5b0b859fbfc45c4165539b83bd21c368c9392e9c0e94e3d759a7688866fb158b0075826f5adf00a4bbf73a8049dd5276ef2a

  • C:\Users\Admin\AppData\Roaming\Httpta\JFRSJPMPUYHQWSNW\StrCmp.exe

    Filesize

    47KB

    MD5

    916d7425a559aaa77f640710a65f9182

    SHA1

    23d25052aef9ba71ddeef7cfa86ee43d5ba1ea13

    SHA256

    118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35

    SHA512

    d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc

  • memory/2608-6-0x00007FFB48D29000-0x00007FFB48D2A000-memory.dmp

    Filesize

    4KB

  • memory/2608-5-0x00007FFB48D10000-0x00007FFB48D2C000-memory.dmp

    Filesize

    112KB

  • memory/2608-7-0x00007FFB48D10000-0x00007FFB48D2C000-memory.dmp

    Filesize

    112KB

  • memory/2608-13-0x00007FFB48D10000-0x00007FFB48D2C000-memory.dmp

    Filesize

    112KB

  • memory/2608-0-0x00007FFB48D10000-0x00007FFB48D2C000-memory.dmp

    Filesize

    112KB

  • memory/2924-31-0x00000000009F0000-0x0000000000A5E000-memory.dmp

    Filesize

    440KB

  • memory/2924-26-0x0000000075740000-0x0000000075748000-memory.dmp

    Filesize

    32KB

  • memory/2924-30-0x00007FFB4E3A0000-0x00007FFB4E5A9000-memory.dmp

    Filesize

    2.0MB

  • memory/2924-33-0x0000000075741000-0x0000000075748000-memory.dmp

    Filesize

    28KB

  • memory/2924-34-0x00000000009F0000-0x0000000000A5E000-memory.dmp

    Filesize

    440KB

  • memory/2924-35-0x0000000075740000-0x0000000075748000-memory.dmp

    Filesize

    32KB

  • memory/2924-37-0x00000000009F0000-0x0000000000A5E000-memory.dmp

    Filesize

    440KB

  • memory/5012-24-0x00000000757F0000-0x0000000075805000-memory.dmp

    Filesize

    84KB

  • memory/5012-23-0x00000000757FE000-0x0000000075800000-memory.dmp

    Filesize

    8KB

  • memory/5012-27-0x00000000757F0000-0x0000000075805000-memory.dmp

    Filesize

    84KB

  • memory/5012-21-0x00000000757F0000-0x0000000075805000-memory.dmp

    Filesize

    84KB

  • memory/5012-19-0x00007FFB4E3A0000-0x00007FFB4E5A9000-memory.dmp

    Filesize

    2.0MB

  • memory/5012-36-0x00000000757FE000-0x0000000075800000-memory.dmp

    Filesize

    8KB