Overview
overview
5Static
static
3ef282b1e-d...98f.gz
windows7-x64
3ef282b1e-d...98f.gz
windows10-2004-x64
3sample.eml
windows7-x64
5sample.eml
windows10-2004-x64
3HBLTSNCNC1...16.rar
windows7-x64
3HBLTSNCNC1...16.rar
windows10-2004-x64
3A_N-啟碁...L..scr
windows7-x64
3A_N-啟碁...L..scr
windows10-2004-x64
3HBLTSNCNC1...16.scr
windows7-x64
3HBLTSNCNC1...16.scr
windows10-2004-x64
3email-html-2.html
windows7-x64
3email-html-2.html
windows10-2004-x64
3email-plain-1.txt
windows7-x64
1email-plain-1.txt
windows10-2004-x64
1image001.png
windows7-x64
3image001.png
windows10-2004-x64
3Analysis
-
max time kernel
242s -
max time network
243s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
sample.eml
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
sample.eml
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
HBLTSNCNC17066 Arrival Notice海運 - WAN HAI 271S216.rar
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
HBLTSNCNC17066 Arrival Notice海運 - WAN HAI 271S216.rar
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
A_N-啟碁-TSNCNC17066-0721-LCL..scr
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
A_N-啟碁-TSNCNC17066-0721-LCL..scr
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
HBLTSNCNC17066 +Arrival Notice海運 - WAN HAI 271S216.scr
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
email-html-2.html
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
email-html-2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
email-plain-1.txt
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
email-plain-1.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
image001.png
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
image001.png
Resource
win10v2004-20240802-en
General
-
Target
ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz
-
Size
1.6MB
-
MD5
87238a84ded30b1ad5d95ee08840b7a4
-
SHA1
8775213547083717880e4e81f192d4891d117703
-
SHA256
7262a1cc0ab7a4d4b18133b20d091f574d102bdff4ab6e4cfd536fa6001c2c19
-
SHA512
cb99c14a709e864549a75fc4bdcf0eb01deb693671eed9616e8f5cdb659c2375630d57b56e1c2ae9c207b181ebddb82df311d36ed0cff6c61e645f674f8a4a50
-
SSDEEP
49152:lr7ql6zLsIwt932PViGKiAPHof46BDfBpjZKEd:lr7ql6P9PVi1p/ofHVpjZd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2216 2416 cmd.exe 30 PID 2416 wrote to memory of 2216 2416 cmd.exe 30 PID 2416 wrote to memory of 2216 2416 cmd.exe 30 PID 2216 wrote to memory of 2812 2216 rundll32.exe 31 PID 2216 wrote to memory of 2812 2216 rundll32.exe 31 PID 2216 wrote to memory of 2812 2216 rundll32.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ef282b1e-d2f2-4ea9-9d32-08dcb9fbc98f.gz3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2812
-
-