Resubmissions

12-08-2024 15:01

240812-sd558s1apb 10

11-08-2024 12:42

240811-pxewlstgrh 10

11-08-2024 03:59

240811-ekb9vayanf 6

Analysis

  • max time kernel
    314s
  • max time network
    320s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    11-08-2024 12:42

General

  • Target

    https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://houseofgoodtones.org/richardmilliestpe/Aunteficator_em_BHdAOse8_installer_Win7-Win11_x86_x64.msi
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f3db0d03778e31143a3f06eee822880

    SHA1

    4e8e9c701c4fc7f37e44efc4f7a6f2a54015fdb7

    SHA256

    bec3bd719a77b995bd28ecf6324d522b06b3e6df1da3f255abb6b3936da29d39

    SHA512

    ac27779f39bb21c23df3b36682ad6242330226a8d4427f26b63ec9f2bf33d3dece7feb5685ebce56b661bd8f9e7d05cb0ec5311a031c0aee3e2b263a71402ae0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3227722382fc8570f18b4abcfc03c8aa

    SHA1

    30ed9caf2ccfef4f43a377bb8835816083f46055

    SHA256

    b5b3f1f3fa36bde174603677aa7e3cd7f63dfba7eddc6c277446ed004a035612

    SHA512

    502fa62859c30aee2682cc5c039be0dc605223af7c2ef40192a5681a42718631855b2154872b974c5015cd34b238da1a03f62f22da061a5214d056503870ee45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f4f8fe4d42975dcecd33362952b10d08

    SHA1

    bdeb9af9c6b62e3ab4d2dbdd0d53dfa1dae669d0

    SHA256

    867bc67c5ea7d970aaafc89fe8c7fadbeb2d6d20817dcc3bfa41c9b231edbdb7

    SHA512

    1797cdcd29c1c32433260cf8ae692e102d6bf0714ac21257ea7cf538daa6f151675f8539fd4f7bf4b9ad2b08db1cfc487e92f537b43b7d5da183d119ed90dcee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa9c7ffc1b5164c10665a49659cf9584

    SHA1

    cccfbd4fff4346f120d8d70fdf8268dcf309d56c

    SHA256

    b6a9eff6e2c0e0cf9aac03b3b2c31c5a09b6b03d9da3338ed69ade35a366fe47

    SHA512

    7894a9a4480c06b2e067ee315a489ac762f8cb2469d7edbcafc7c8cacdc8d3393214f6d59884875a278cc6a35ea048ad050347e33dfad23320d9b7ce96ced3fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c73b8547ef37683611a530cd49c769b2

    SHA1

    c895021648edd54a928770ad79e8ea0f4fb410c1

    SHA256

    b30d26465937c3b9477509dc146dac0daed06861a80878502bd3aeba70e5880b

    SHA512

    05b7bbab3ccf9940edcd1f0cdedac861cb12edaf56d363af336438c209e7411e7826f4a98633e808cbff70b9b7e987b2100be8647d3e4b736b1f54c0bc60061d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f95a88353e15fd6685594f3faf90d2be

    SHA1

    c62ccdbd86451c6b9378ae4391c46ebccc96f3f5

    SHA256

    85003dc9c383f77475a23590cbea758467751fbe69e6cd06aa8c4ed43f7e2390

    SHA512

    daf8e63e51cd55bbe02720de3e2e796e2e2cfd207aef8de09b33327e0c6beeeea596636ba6df90634696e60125c44151f4fee9fc1c7be69529dea1a866d1985f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    65698e134cc14cd0b966c2a694d90e0b

    SHA1

    8a020f04703017519d4c4faa8cfe9a3953ced3c0

    SHA256

    d56aa8a59bd0c021cdfa7f19906d4fd05df0458335cd6df36dd2137b05493319

    SHA512

    47c902058cea89a04410ef0de35ab04887f8d2ffdad41677aa48db96e009e268913f069335d3b00726c5d08ec425821c962e58201c1ad7818498d35fec12f7cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c02355b58f1ac8e4581ecead1f99ec3e

    SHA1

    cab26b00b68cfa1c949360175d1663e223829dcb

    SHA256

    e328035a7a471d1f5f3183dc0d0c79890b2445885152f6806dc12c1706d46f18

    SHA512

    b2c6944a2c04f8764174fc77d80dd0dc65eae3c961a5dc66b33749e82f931287206043a6469decd02ad60eec68e4fa30fb07d333bfe9fac5fff8db9e5b22526d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    366d5c1aae0806b38435050b2e134489

    SHA1

    6a6886e3509164740d4e436ed890960102c24934

    SHA256

    b9ca5625457b2104d23706cdb3bcc8feedfe2269cc87ca5b7a33fcec3d67745f

    SHA512

    af149516a7bbda56f063cd0de17a354fd43e366f3378505c2faf73b70aefc343a19b62f250ed09427bcdede045c54812ccdce5a64d4a5b3e1d1dfaa680029370

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2018048ddfdfdd847b2ea0aabff1d642

    SHA1

    99421f3f37fb6a14467d74ebef9ee689bd8e1335

    SHA256

    42cf0e55222af2b147ec3017a388abc6caebf81799ffa679de7291ea814838fe

    SHA512

    d04cb9710c3020e90ce7b857d2ef2e3a52e711751c00378cb4d084cbd82bbce653b3462c4919a9ab88be615d03ea6b3904937d4ea3d69cc9028c9cd6e9e5e590

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    85efaaa892b252277cc71c63d1d4d66c

    SHA1

    fdb3e6825014b1b316094bdc8a50866f757793b7

    SHA256

    48cae4be95089b6306a4a41863e621f670b76b67825fa489bce0d44722751287

    SHA512

    c90aa4f896f2009d04b033798b70c1a62de26c056c162d2059d10868dee85edd60cb5f17f5ef7c81ac0b3f2e466af2734a55a5c856c2a016eb61de20f705a4de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2399e4adecebf5f7617e18f263b4c60d

    SHA1

    34eada81ac9898fc1d39f9a50b5944c6f5448305

    SHA256

    5639f621d7d4f2b216cf99afe2270bd78e63c83d7a95d5eb3e76a3ee799bf482

    SHA512

    a2df82179368350508782cbb142c3e140ab7289d7408c7084a5e94b6d69edafdc4c664cebcd22957ad433724c6df39415f8325cdf4003f5bfa6eeebd5ae1f13d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ebd38cef8da305049d5546fa66652b0d

    SHA1

    4b4fa2fc0be3fa639666217f88834f7ff0a6df01

    SHA256

    18f50c22c2829233d05cd61a37beee59337319fe176f192951f52d8769630331

    SHA512

    354fff3f59fc1cc4bc6d556cb76e9cd8e2793863d9e31a1be346aed6c015754c90e8e9b97b87366787d64f64fa09266caebc33bfbcdd000e2db169fe06dd00a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c324f9e60b7f7d852a2fb0bf086e8d86

    SHA1

    8fa37788448a7bcc3700caa2b6298b77a238d3ec

    SHA256

    64299c4804ef0d5c1e444fb031718a178a78862e519d728f824abb06f0035948

    SHA512

    6a8334f64b8f3f6e1a85be4bd1a644d99a9dc63cf5f37e313998a042a53f8f55cc87289568e32290d845c44e29fa54d1027d9d4d18c490d92db0ad8ac86b8e76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b014e7b8c26224765bf202c043f91c1

    SHA1

    6732bc399b828db181a58f564482ec12f5aa42c9

    SHA256

    b20e65bdbee680698375edbf1df3e86d00d125206d18f6d6c3748c659d6c2974

    SHA512

    65b6e48950c44e58395a1b1807dfdc4c3e18d128c18b2da2dd84f1b492ee60fe37536d17d1217203fc70df737f7b0d3c227442c7d2699af880e7ebbc4c7414bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e3c456a0ee1b7049d254621be9ee59b6

    SHA1

    3ea2a39889a558644ca06266ef0462c0716efef7

    SHA256

    fb806717d30ebee96db85ac33f054decb03a34d0eca60a974b4cb5f278c88920

    SHA512

    f7d30e6c389cb6079c876023f4ed11b2c96b5a653509a8b97bb584748c94e91cce81c6bf4e9415bb652190229076d9ec809d50a0b434d9ade1912319b3157d15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d29a4c67a47d8a066875d3c8fe8b5aa7

    SHA1

    c712f08a1ac7b1a1f5c6a4da2567cb072be7a68f

    SHA256

    5f3ac8091237d7948f897ba9d4ffcfe728d269e333bee5f33c802b2a50db0d9b

    SHA512

    0663e464e4f30087644a3ea9f5d4169d068d69905c4fcc7602ac2073e1d74d49e5effa1238dc3e193d219cfac7ed31bca08c282a355f7ad2d7f6cf7f2580f5e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5449a274edc1d27802a7854226e2293c

    SHA1

    e88781627c166f46154aa382a4c4f0f573cd93e6

    SHA256

    e36bcc88bce7d692ba97dbdc6dc22e12bab337659d3e5dd29598d8407e5d273d

    SHA512

    2bbeb32167bccb6598cd302fd5b8cbd5a3f1ca3cd3a5f333357090eef3148d5a2941b51e4d20175db32c848a8f03cdf4d9768b1953e38113f6f9822bf97232e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    014d10e983edb9fb49d8e0413301eb30

    SHA1

    16cd44fbb6ff5bef22aa1785e2c8fda4a95b5efc

    SHA256

    33b4000814412eebf7e3cae70eed723d6b02403f15aef1fbb3e821268cf1b89f

    SHA512

    24d2207d7cd79e13da764a35cff007deda06232eda1e663022183ab535e0828dd1cb75c9c45f3899d9a7ffd653f062de129bd43ad6202f4185d3a1e62e6900e6

  • C:\Users\Admin\AppData\Local\Temp\CabC890.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarC900.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b