Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11-08-2024 18:24
General
-
Target
Black Mesa Monitor Screensaver.exe
-
Size
2.9MB
-
MD5
89044caf59d133723b2ca8386ba812e6
-
SHA1
ecb695a01219648fa53e51d9118610c48fc88d74
-
SHA256
0af8d5f83519730a4b3b7a40e91e059f54d58a43191671aef17267810ed88aec
-
SHA512
0c9912a93e7626cc625485884addc1c1f2ab8b8401f6e73f2cbb8a9c49a843569e114568eade86e8c23e1d6f8b394297bd35191be834bf5784244096a6d45e79
-
SSDEEP
49152:C9vxKshalUdKJ8z2xZ4Hrs1YShHZdwL8npzbxBAN0W/oRadJqJA8NU:MvOyK8zL419dZeLwzbDANXUad9
Malware Config
Signatures
-
Banload
Banload variants download malicious files, then install and execute the files.
-
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 8 IoCs
-
Modifies registry class 64 IoCs
-
NTFS ADS 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JQAQ7.tmp\Black Mesa Monitor Screensaver.tmp"C:\Users\Admin\AppData\Local\Temp\is-JQAQ7.tmp\Black Mesa Monitor Screensaver.tmp" /SL5="$40112,2762590,56832,C:\Users\Admin\AppData\Local\Temp\Black Mesa Monitor Screensaver.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" desk.cpl,InstallScreenSaver C:\Windows\SysWOW64\BLACKM~1.SCR3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /p 1969744⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /s4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\Black Mesa Monitor Screensaver.scr"C:\Windows\system32\Black Mesa Monitor Screensaver.scr" /p 1969744⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408KB
MD5fbe78fb6977b6ee0e98783e7089e82cf
SHA1630afbec2cbf6098fccbe1f0e6ecc55a7b9e5e4e
SHA25616645007455bc40e2aa8da1b1eb5ab07f7ae0aca9cae3b90668b569bed5fb6e0
SHA5127c1b64bb8ffc101871644dc0db37cabcc4aaddf169662912b84457e9426faf3b57f8dcdafb5ff63946e1e531a8ffa9a8b8a302abfa1ed9063bea7add4e7e08ff
-
Filesize
801B
MD5d77bdddf6a46fee68c17080d37c6633d
SHA1fc5046888da49193ac54faf54298752df8ed4c88
SHA256039cb063a6f59038791583f76780c6d0c6098736103d7cecae5fe0ea9d1c28d2
SHA512be5e748649f3bbbf576f46c974d71c50d4d80ffb3f603953f831894e7f2eeca303c75d204624e463d3772ec80c9bf90aea227d3109bd7a4c19d3a818c64d1ce4
-
Filesize
141B
MD5177599e4e84efc61ed8fc926cf67537b
SHA11827b75f0ccdd1583ccd8e7c5d0384cb363efc1f
SHA2565439ae835599b1007ceae385acd9c935abd3e0274279aa409ae2a36d8c4fecdf
SHA5124b07c8eac66a43bde113370f40de1340e16911d3dd55d9ed1c0a61e8f45171a3fb80b44c7bc0907e47af8e57e85ae4754e7e8e2001ed35100f4abb39be74a260
-
Filesize
141B
MD53088b319faac391e8064545b860e425f
SHA1003ddc389ea1b31c8d93d34b3dc4c40b51db4db0
SHA25653eec94f4a1f0ddd2001a67177d576de65d09216f624d50f31ed2adc20a8cdc8
SHA51232146bf2ebe68e096dd0cbf3da39f0cd9ea0e814bcfdf6cad29e318fd53c46f8f894e668e839df6f76f2deef24a8c7e309f51f65552844c85c72fe2d0ee536d0
-
Filesize
141B
MD5905b4a4ea75110acbe5343d0531e05c7
SHA17d88f23f2b911211695df3d2f99593daeb007041
SHA256627c08c6c31656e86207abee698034f156504986be65867f8179bcf411ee8a12
SHA5122c65b9de79bbcca36046a256227f6d727ae7f0d2e8c358b5a44446289d48e35c0a43b1fd2697efeb787e40014bdad269686fe55b249922079d76288b470c1e1d
-
Filesize
1KB
MD5020570a88c0692f7f3d1d42379058765
SHA1bef5e581e4c7ef4f171c165911145dca9c68287e
SHA25616efc91532dc5d3d151ce5bdb882e6831d562a54bf8592c31052159ce929cddb
SHA5121f47d19f8f2dc77e7ab9fa12b096bb41600f84b67cc22fd41886b9a759c32c3565db23a1dfe039a1d376ffe7d510b3603f0acc5df14886d254235329e074ef9e
-
Filesize
1KB
MD5501b0d8b22c7edc8da4d2cdc27c47475
SHA178fd2f35000def8722d93747af4737d0f64ff4c8
SHA25698cf4bfab67eb63eca03efb20c1928328a0ea65e8e8e811798d2686763844dac
SHA512a596f60f6a568be76ae00e58155f62b3101dbb1002b9dc036a31377f0f8566176f344a01abfb8421e14349b3facdd198166dbb1c61563702d669db52c84cb759
-
Filesize
1KB
MD58d74686bf2b7ce117c7537bf23535776
SHA1b0f7077bc7a654573d2da0f89050acecbe225142
SHA25637f45956f7978cf370a8ca27a7ae620710388b70cba91765b65c600b3e63e7c7
SHA5129cc58bf977c87dbada28e3eab93965c50143620aff2a92ceec7d4fdae90189f5fef7ddea44c9b0ac7c6172108bf637678698adce282dc52a0a2f154a20eaa0df
-
Filesize
1KB
MD5a39005ce895e639bbc59d632b69a1beb
SHA12332f9f589ded1567bbd6d68a3caaa0c66f3660a
SHA256ea3e3aadafc1e112948a7efb7935c3cda3e93af011397b6769e51e85efc27a1b
SHA512e4666011204b84a3e800a4f2b0a00a59cddb9dcb50b51b59c925ff22b636817db9380b50416c164fd677b3455b680270643c30c54219986684e1a7b7affef569
-
Filesize
3.2MB
MD591cce0d13104f694fcb110df259189fc
SHA15d663ce4b6d877abbb937897a3bf00b933d815e9
SHA256932b803b498308d97782847fc00c6f54dfacc847aaf24ffb658064f3622994fd
SHA512af9d8e7a0b4825e516196e4b8d9c510b71d8cc8663c9280b7db413e1193440c1bb7b5faa5de41850cfe2299b09526e3eaae1f086f7e1f15113daa23b31f20eea
-
Filesize
701KB
MD56c82d5316ed0cd83d6f9e5a9f0914650
SHA1d642c72bfe4b83609c3466c7bb85e2f53b6be48b
SHA256b9e1fc89ff8ec82fb050bd32829b45f828d84226a6890ab385221c7fc6a462ed
SHA5121cd031cec42b5d6b08c66bb1944ba8db7de0f1363e68cd915b81eaa1e53752e43560010389f338840f11b34893a8c5c132c843bb0d8ef805713152606f0586ad
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
690KB
MD5a2c4d52c66b4b399facadb8cc8386745
SHA1c326304c56a52a3e5bfbdce2fef54604a0c653e0
SHA2566c0465ce64c07e729c399a338705941d77727c7d089430957df3e91a416e9d2a
SHA5122a66256ff8535e2b300aa0ca27b76e85d42422b0aaf5e7e6d055f7abb9e338929c979e185c6be8918d920fb134b7f28a76b714579cacb8ace09000c046dd34d6
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
128KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
40KB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
40KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
128KB
-
Filesize
6.2MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
6.2MB
-
Filesize
6.2MB