Analysis
-
max time kernel
107s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
10/08/2024, 06:32
General
-
Target
Diva-146-Winstaller.exe
-
Size
33.0MB
-
MD5
908bd2a2b3f9db23de9e89c80bf90cea
-
SHA1
401287aa321e8b8ac0510aecf0edf09287ae0f5d
-
SHA256
238bb5eac0449a8a05b28ce605cd638f1e70ff843b99c2453e36b451d6ffb218
-
SHA512
c15f917ef97e04af7007b4c0fe1a6fbfaa7d5fe6003496b7ab00cd90349fcf68567a8f131936972e144e7617a9ccadeb5dfab8bb2241b2403c0ea70e87e02227
-
SSDEEP
786432:Sv1ejxhKdRKMWytYl9KA0JdZJf6mjZWgdb:1XElNte9KA0TZZ6MZWgdb
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 12 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 14 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Diva-146-Winstaller.exe"C:\Users\Admin\AppData\Local\Temp\Diva-146-Winstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MBFAN.tmp\Diva-146-Winstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-MBFAN.tmp\Diva-146-Winstaller.tmp" /SL5="$7027A,33516112,899072,C:\Users\Admin\AppData\Local\Temp\Diva-146-Winstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784B
MD5a1659743da5f117c1492940713b2701a
SHA18a5785e38265ea91386cc81c78042f4a047c4193
SHA2566ea2c65223e219339674bc805bf3938ee38fc8c9c3ad60b2859bb28e4d3e83a3
SHA5121183fd2f3dee3252970fb1575128579c07543286ad587ec5a7af9aaa1df3c8d8c59c265a5014c2b40d2330a06658a6cc779996ce87006e7cffe2fa74041c6d62
-
Filesize
814B
MD596adcd2ccec92667aa6590220879e0bf
SHA13ba7a8693f59f566fb2f200f44cf251a6400f2a6
SHA25603c22cea7428ca6ab080155ca5102fb22e1d5329559005ba676bd7cdbc4d84d9
SHA5121161afb7a14104e20240f5eccf7507a5e24535fad38b0ccc5c00e019b74473cee57988f681f8cbdcdb6c0ea8e4431151876ec4709cdeb085df5b12c01ae11f17
-
Filesize
790B
MD5466f756564cd7b5afaea4e2f6ec15001
SHA14407afc51845c36c81121f2d1e920c5066d8ff74
SHA256f43479cd5c31ef8dc597a1c0a2490929ffe1e39d8bac075cc1ec66a4ca6da2dd
SHA5126a06a3b6052c303bd53b4dbc067ac2dae0e4da9c96df95aadb7aa0d91e37f92c0603f0ce4b4f17f8942ea7173bbe1f1e1d4adf9f02dff3d7ece300f378ccb3d3
-
Filesize
14.3MB
MD55224c9441a93bd8bde0ebdd76ab85850
SHA10723cc7d6c4b020d79f67c7b699edd921a737821
SHA2566747034d9daaef3845506e78f209c5386e4c635a614b709aa014f0110e5affe9
SHA5120a8c62c5a760d2ae6593bb2710422302211233e0cf861d0841a62e54029e95b55ea16758a420ca48faacdd2c36c3d34a7f0b16e5e3e244898ebaa005ba1f7e6c
-
Filesize
778B
MD5e958964db653a1d0b1b40450d8e8d932
SHA1d166b26525874b6d8aa7c932b7bea04efbb20bb5
SHA256c259b699aab2f8abfaed02053638b497a87a6dc9fb40ef1f58e30528bae33391
SHA51261fd875e1156f93a3b9d1df1aea6aa3d416c1010d7e660524c3c55480e0a33ad9d89fcfd1476e5e046da404c68daff72bd7b63c5524048b0c72378565ca88907
-
Filesize
12.4MB
MD5238014c960d0f7f361f6d7bdc7172089
SHA1db7bf0d2f183c05788dfa997c86ec313fd53cca6
SHA256c35917aae56899f570aa9495b596df85a39b477839bcee4e8794a5e4052457bf
SHA512a55c407b3ca644a458177df074729add6022457521acc4320e0b078244864f483d82d1b76721db8534b94eebfcab27252ac23119535d086f23a83bc6bfcf04ff
-
Filesize
81KB
MD548557473e909c3bd449175c7e23f54e9
SHA149e395bc501943a742aed2698dd1883729e6065c
SHA25687497c9871aa474fcd9faee86f806d7294764d084c110da00e087b5bf38ce438
SHA512ec3c99f0fa0cd81aaa3cf8450742c26e31c40f3a22c7d5ba64f097ad469255bef6b31ae6e7207c8876c726fe3757902ca8d7094c9b19c432eb269ebc5397904a
-
Filesize
3.1MB
MD594886ca6658b3a1acf424f622f40aaca
SHA13b04ffb6f21391cd09c171a46df1449ed5aa2fdc
SHA2566d2c509c0364b5f92829e4610a5f8f5f8a1ee1e4fffaa93ae41a370839adaddd
SHA512a2b9fcbd63ec2047ccb34248c3bc7e9a71efd711d1dc5f3bfc745c82194e86fc74def015904525245dd435567811b8294fbda25be5dd493d99a008b03cce3e42
-
Filesize
728B
MD5c6ff6d4358e1f4cc721b5b710337011b
SHA1a0935c433410c002e9865710024312767d9c3d6c
SHA25692fd90a0dd0b5da08aee68db9b9083fb20e517e78364a571c104020341e73726
SHA512a80b61fc4064f98fcf597fa0c29a39a5868e47f972971f6fb508754f9f9c51b945c9c8678e50b7addd25a772b7eae8da8130d0ccdccf03e18cb0f2f17fb66ee6
-
Filesize
932KB
-
Filesize
728KB
-
Filesize
932KB
-
Filesize
932KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
120KB
-
Filesize
3.1MB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
3.1MB
-
Filesize
3.1MB