Resubmissions

12/08/2024, 06:02

240812-grwm6ssfqc 7

12/08/2024, 05:19

240812-fz37jsxbqk 7

Analysis

  • max time kernel
    247s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    12/08/2024, 06:02

General

  • Target

    Heaven.Will.Be.Mine/Heaven Will Be Mine/HeavenWillBeMine.exe

  • Size

    635KB

  • MD5

    42b6538cdaaf017a408b1bf04e0cf28b

  • SHA1

    ef28a03d80df05954786689f95fe7a942099f335

  • SHA256

    76aabbd06c5dc729ec68d9bed383e2a18711bb286f62e5136d3682c6c852ddd0

  • SHA512

    a8575c03c6e20e3dc9602b5bd4fa13b7dd7f5bcc7f816dc6e95b561e00f5f504931891b3ded3147d6a05eaa217e5e8e00739b3473f0bfc9ed3b65a9785bd9de8

  • SSDEEP

    6144:V9fYunoPZRR1/FJ416Q7dbMdKVfl1llT+HYsSO/wF3a89QnQnPC8g/O4FIoCBuA1:E+oTnFJ48kQ+PFO/wjQnQPI20uu1K9

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine.exe
    "C:\Users\Admin\AppData\Local\Temp\Heaven.Will.Be.Mine\Heaven Will Be Mine\HeavenWillBeMine.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1664-1-0x00000000043C0000-0x00000000044C0000-memory.dmp

    Filesize

    1024KB

  • memory/1664-0-0x0000000004780000-0x0000000004880000-memory.dmp

    Filesize

    1024KB

  • memory/1664-2-0x0000000004780000-0x0000000004880000-memory.dmp

    Filesize

    1024KB

  • memory/1664-3-0x00000000043C0000-0x00000000044C0000-memory.dmp

    Filesize

    1024KB

  • memory/1664-4-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp

    Filesize

    13.3MB

  • memory/1664-7-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp

    Filesize

    13.3MB

  • memory/1664-8-0x000000001A1F0000-0x000000001A2F0000-memory.dmp

    Filesize

    1024KB

  • memory/1664-9-0x00000000062D0000-0x00000000062E0000-memory.dmp

    Filesize

    64KB

  • memory/1664-30-0x000007FEBE260000-0x000007FEBE261000-memory.dmp

    Filesize

    4KB

  • memory/1664-44-0x000007FEF3B70000-0x000007FEF48BD000-memory.dmp

    Filesize

    13.3MB

  • memory/1664-47-0x000000001A1F0000-0x000000001A2F0000-memory.dmp

    Filesize

    1024KB

  • memory/1664-48-0x000007FFFFEB0000-0x000007FFFFEC0000-memory.dmp

    Filesize

    64KB

  • memory/1664-75-0x000007FFFFE90000-0x000007FFFFEA0000-memory.dmp

    Filesize

    64KB

  • memory/1664-92-0x000007FFFFE80000-0x000007FFFFE90000-memory.dmp

    Filesize

    64KB