Analysis
-
max time kernel
25s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
11-08-2024 18:24
General
-
Target
Black Mesa Monitor Screensaver.exe
-
Size
2.9MB
-
MD5
89044caf59d133723b2ca8386ba812e6
-
SHA1
ecb695a01219648fa53e51d9118610c48fc88d74
-
SHA256
0af8d5f83519730a4b3b7a40e91e059f54d58a43191671aef17267810ed88aec
-
SHA512
0c9912a93e7626cc625485884addc1c1f2ab8b8401f6e73f2cbb8a9c49a843569e114568eade86e8c23e1d6f8b394297bd35191be834bf5784244096a6d45e79
-
SSDEEP
49152:C9vxKshalUdKJ8z2xZ4Hrs1YShHZdwL8npzbxBAN0W/oRadJqJA8NU:MvOyK8zL419dZeLwzbDANXUad9
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 7 IoCs
-
Modifies registry class 59 IoCs
-
NTFS ADS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-757D7.tmp\Black Mesa Monitor Screensaver.tmp"C:\Users\Admin\AppData\Local\Temp\is-757D7.tmp\Black Mesa Monitor Screensaver.tmp" /SL5="$60138,2762590,56832,C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" desk.cpl,InstallScreenSaver C:\Windows\SysWOW64\BLACKM~1.SCR3⤵
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /p 1317224⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /s4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /p 1317224⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5fbe78fb6977b6ee0e98783e7089e82cf
SHA1630afbec2cbf6098fccbe1f0e6ecc55a7b9e5e4e
SHA25616645007455bc40e2aa8da1b1eb5ab07f7ae0aca9cae3b90668b569bed5fb6e0
SHA5127c1b64bb8ffc101871644dc0db37cabcc4aaddf169662912b84457e9426faf3b57f8dcdafb5ff63946e1e531a8ffa9a8b8a302abfa1ed9063bea7add4e7e08ff
-
Filesize
801B
MD5d77bdddf6a46fee68c17080d37c6633d
SHA1fc5046888da49193ac54faf54298752df8ed4c88
SHA256039cb063a6f59038791583f76780c6d0c6098736103d7cecae5fe0ea9d1c28d2
SHA512be5e748649f3bbbf576f46c974d71c50d4d80ffb3f603953f831894e7f2eeca303c75d204624e463d3772ec80c9bf90aea227d3109bd7a4c19d3a818c64d1ce4
-
Filesize
151B
MD5fd9c453013da37a867de4ec2db984841
SHA12b6805ade0cbfa527565333aac0be12616825a90
SHA25643612ca391f7d8425d53e688c04c50520a75f327ae55b4220059b1e4f7bd1326
SHA512146eb11b2c22115d6911ed8319be49b2701bb17c57fb90f2920e21bfb4d6631cbf8b778aedf07563b511b026d9cc3f6a91828e6df8e42bf6989c8af8867b9174
-
Filesize
151B
MD549934729c9eff8e8884fd08cf7f1bf8e
SHA1bb55cd42c56d698dc8ccb35f525271c91da1e2d7
SHA25686f01f3c69eda8de3f9e30fe8a58971135b4ecce8382d797d8a3da31142bd7ad
SHA5123e340dcb95c823e645f18769ca416d27d82fb6ef5018c78ab4ad6bea1eb0597cb6207b77fc83e3fea3179ee5fb38a267eaf8ca38b4f029e992b7824679240d85
-
Filesize
151B
MD56feb2cc13c7c52814bb2f030d2c4b41b
SHA1b0d9fd87278744d6fad1d985fde92e77b7f1f332
SHA256fda8c6a4ba486450a06394da22243a40f618eff04ee4116390ae10200601737d
SHA5120d98c7a2fceedaa8e486b282e7034890440adf2fe06c0862e83c6013811e7dbee13539a52c96785f8b8d0eff15f5461320c5e081b1c1d553f7196ef0ad7cf977
-
Filesize
1KB
MD57014934e6077847aab722c935384bb8f
SHA1ac64a966844b4507b60ee3cbed4545402a0eaca8
SHA256dbbb01f8e2efbf672dbea860d22356ec8025b6ce95a8faa8661d65e3c96644de
SHA5124570b8e203e8142ae3e032c4f67c92b72622d42c3500ec5b7843f633c3f3201c1a29d434627aead1a3d38f5131b03a14bd766afd0e5713be4a2057e2c876d13e
-
Filesize
1KB
MD5ad14e0edd2c6ec4391860d4f1b4d5d25
SHA122ddfef5c4ffa9030b08c6372b6694d987033732
SHA2560f07ff61fa78c825add8fef8087e536a0c658d46c5ea948ba2d4e173e5903954
SHA5122340341f45356b6628b2246c7f2c96ec760041d88ed328eb82ba8d5db64e9cf4f301e7d3b9e6728aeb549f424082f9baa5275b77e0c8e8dfb3f9443b89296520
-
Filesize
1KB
MD5bd861f4cd48640ade200aae6896f45a0
SHA18fc7688b5f1fe42e629d2ce1c630dcd77f6a10e6
SHA256c0c797843ebf5387d14252f1147601041f0b7b680192ad2a29d9629205e89399
SHA512b2e053e96936852305b70b9764aed68a25e46af1d80a35d6734e7e77f089aab2fe8f89d620bf9ef99421cbb7b88ba4f7c8c2d892f307e2250224580c42269afe
-
Filesize
1KB
MD50aa5aeb580565321b18e1d1f25d190ba
SHA186b0a1e223dcfcd90846d82e722bd7410fb5edd6
SHA2560d01a6f675422526a2f51b6ff95956b48de38a0324afeb3cac19334c1f396217
SHA512a376c40bdd0f3bf32938a522def539d222d73f5549b943ec2b90fb93451903fca8f1eb258601577a5c16d6bd70786235b4d20146129d02461d439557644cc5f5
-
Filesize
1KB
MD588f6840df20957085734772ae60ff28d
SHA1ba8665bd32265fb5685ebf9e82b3f1ea20e41e8b
SHA256fc9853a10bdef43df464172a3030f6ff280841265097bd39d17c561cae2314d8
SHA5122adfdcc3097981b26135c25fd1a03621a1ed2a1573cbf742059b28835f8bfe7089ea0aeb1c30393299b74939e8c8135d4112c20c47234653e17fc280cd89cf2c
-
Filesize
1KB
MD56717e79545f3b286a5e79bb1bb41ed57
SHA1ebcc7945814b33dde160051b613e85f774417ec2
SHA2567403abbe5b0597da3f64f1c183d6499858a92f2e92e851ddfca3a3fd50521e85
SHA5129cece5efb808f1410440a14b7113642ed05434e78678bf7d17392e5543127a4b0748e33174dfbf4d2ed204efb774df504a63138f23d8dfc15c33431c5c7fa581
-
Filesize
690KB
MD5a2c4d52c66b4b399facadb8cc8386745
SHA1c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA2566c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
SHA5122a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
-
Filesize
3.2MB
MD591cce0d13104f694fcb110df259189fc
SHA15d663ce4b6d877abbb937897a3bf00b933d815e9
SHA256932b803b498308d97782847fc00c6f54dfacc847aaf24ffb658064f3622994fd
SHA512af9d8e7a0b4825e516196e4b8d9c510b71d8cc8663c9280b7db413e1193440c1bb7b5faa5de41850cfe2299b09526e3eaae1f086f7e1f15113daa23b31f20eea
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
752KB
-
Filesize
752KB