13082024_2327_12082024_MSK332871.IMG
- SHA256 f5425a67ecaa6550fba75f9033d83c37f082382f1387c5eea1e9b342f715056c
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MSK332871.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
MSK332871.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240705-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 13082024_2327_12082024_MSK332871.IMG
- Size 1.2MB
- Sample240813-3fxa8a1eng
- SHA256 f5425a67ecaa6550fba75f9033d83c37f082382f1387c5eea1e9b342f715056c
- MD5 d3a57c8ddcc711179d799ae7fe67b1ab
- SHA1 3414bbd59ec1a9a31d0072b7273bee792623d8a3
- SHA512 fc6a579ed9d75639961fc271700f2d3346d2d868f3d5da9a01707ef2b93cfc7ce8b04f0ff69f0db69d5c51cb5b1b640ccb21f81c5782997fe916982b5e9a2445
- SSDEEP 12288:2YuTSkr4ZmNidYqsMpiJrCBAiuEqS4bySmb+JB2HqovnC:2Y6T4ZDhtBz+SOyIJB2fC
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack003/$PLUGINSDIR/LangDLL.dll unpack003/$PLUGINSDIR/System.dll
File Explorer
-
13082024_2327_12082024_MSK332871.IMG.iso 1.2MB
-
out.iso.iso 1.2MB
-
MSK332871.exe.exe 461KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/System.dll.dll 12KB
-
Femlings.Fis267KB
-
Kastepiles.Aan108KB
-
Supermarkedet/renovatory.gol1.1MB
-
empressements.txt556B
-
hooverize.mus911KB
out.iso
- SHA256 f5425a67ecaa6550fba75f9033d83c37f082382f1387c5eea1e9b342f715056c
- MD5 d3a57c8ddcc711179d799ae7fe67b1ab
- SHA1 3414bbd59ec1a9a31d0072b7273bee792623d8a3
- SHA512 fc6a579ed9d75639961fc271700f2d3346d2d868f3d5da9a01707ef2b93cfc7ce8b04f0ff69f0db69d5c51cb5b1b640ccb21f81c5782997fe916982b5e9a2445
- SSDEEP 12288:2YuTSkr4ZmNidYqsMpiJrCBAiuEqS4bySmb+JB2HqovnC:2Y6T4ZDhtBz+SOyIJB2fC
- MD5 SHA1 SHA512 SSDEEP
Password
infected
MSK332871.exe
- IMPHASH 61259b55b8912888e90f516ca08dc514
- SHA256 51b09071a66f4f8d1da32b279026b0f482b2ef176b288b2c87b65fbadce4ed43
- MD5 690a2e0906e6cedf5a4e23b13e661387
- SHA1 a9c7f100eda3cd8f6fb7563187c3d5d9ce625318
- SHA512 53eaf4f857fc749a1c1d4d7af8baed2059dc92ac4c6869fc608ed0181b6eab285d7927ebd2a487f78de7b5b96948af7a132e859bad04aa3a26f0710088edc8c4
- SSDEEP 12288:AYuTSkr4ZmNidYqsMpiJrCBAiuEqS4bySmb+JB2HqovnCL:AY6T4ZDhtBz+SOyIJB2fCL
- MD5 SHA1 SHA512 SSDEEP
Password
infected
PE Signature issue
Digest
95:62:5b:1b:70:7c:b5:f6:18:3f:5a:c2:e0:5f:9a:53:c5:1c:5b:1d:19:66:2f:78:3c:ff:a9:aa:b3:90:f2:60
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Chains
Aug 5, 2024
PE Signature issue
Digest
d5:e1:22:0d:40:c7:bc:22:08:f7:93:44:c9:72:0a:9e:1b:42:a8:d7
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Chains
Aug 5, 2024
Subject
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Serial Number
6a:ee:96:d5:f8:b9:8a:b9:88:3d:0a:82:1c:61:62:5f:d3:5a:f1:63
Issuer
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Timespan
Jan 12, 2024 - Jan 11, 2027
Subject
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Serial Number
6a:ee:96:d5:f8:b9:8a:b9:88:3d:0a:82:1c:61:62:5f:d3:5a:f1:63
Issuer
CN=Prenaris Crapy\ ,O=Tinetare,L=Hugo,ST=Minnesota,C=US
Timespan
Jan 12, 2024 - Jan 11, 2027
Minor OS version
0
Major OS version
4
Entry point
13888
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW
shell32
SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
ole32
OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree
comctl32
ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
user32
GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu
gdi32
SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject
kernel32
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
Name
.text
Size
26KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
- SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
- MD5 68b287f4067ba013e34a1339afdb1ea8
- SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
- SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
- SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
5439
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW
user32
DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC
gdi32
GetDeviceCaps
CreateFontIndirectW
DeleteObject
LangDialog
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH fc0224e99e736751432961db63a41b76
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
10879
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError
user32
wsprintfW
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
867B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
120B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
662B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=14, version=7299,
count=20, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=48, version=9044,
count=1, id=42, version=8803,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Femlings.Fis
- SHA256 c98a99219a9811c9c7c7f82e5d9edd6a91ab35dac8c7f2422c1106190582c06a
- MD5 689707629df3b931d6c35b9b5f4adbd4
- SHA1 f2c2e9ba20b05db9ea36db4f711473c599b1c400
- SHA512 d9713a92b952e5cb314e92dabddfcec34a5f790ab8aa3659ee8ded6519fcb5e0ce67c66f7bcebdfd61d44457096f2b6c5fdfd1744add44fe2b6da04c7f8d01ca
- SSDEEP 3072:mr8T3IoKffo93VWdpACaGiiCE9sRaJ870aJSYbM09qCiX2JyhmFOVztsET6+8MgV:9DKfewPiiVp+0cWb2Oo6PBC2VLQ3UIMQ
- MD5 SHA1 SHA512 SSDEEP
Kastepiles.Aan
- SHA256 363147efe2995653cb0624130fdf43e79537a352f17bf4a1fc2e28e77c417364
- MD5 ed722538abf3f29494f6536ec94b7d65
- SHA1 8bddd4ab5421ae7e936952734e215ccb0aa34691
- SHA512 4e85d259e070c2c1c52024935a67ebe2c3b9c4a4796012330992736a9c9edc761d69ff56fe54005ff6304e18235a4330efc6d1e03d32832c334193638e2e5069
- SSDEEP 1536:7wBgXjNlrp+2e0fPBIhK9KJpuhoRB9CL5RVLk/DmkhJ2mr0hB:xnuXg5zLkfc
- MD5 SHA1 SHA512 SSDEEP
Supermarkedet/renovatory.gol
- SHA256 609e39809a889ecf96af8233eee0509a9f8d7507ea41ddc69b1229be4e3367da
- MD5 96e4e86c2be4449afd8e03947fa2c985
- SHA1 3c6b605756f22220d23f067aa9f91820da5df733
- SHA512 ed3be874bff7cb7368c7db5bcd30f597591e845ef623420cad1c6cac01815cc927cae9619bc032a19ee7fd7c4ed51548e40f364f6ad02f7c057bc29b12e1c452
- SSDEEP 768:eFlAe+SNuCUi/off5qWr4wvrkBm8by14CCQPwKmTrltkyOeqkVcf/DCxJI97Ezs1:egkg4Kq02WFdDGG23Vvm
- MD5 SHA1 SHA512 SSDEEP
empressements.txt
- SHA256 99d0cee179afb233cf5462cb9e6636b55395f87d011f1940933921d47cf9be26
- MD5 f0baf46968beb1e6ccba492b2c91829a
- SHA1 bc02922a4f4596270793c2116122b2666c92f72a
- SHA512 afb809d73f08c98f5b74493eada3831f4c82226ed53479dd098992b7b365c46cfa2cebeef3e7478b0d30807a955b1c63d99ad33c32912e33383341513698b802
- MD5 SHA1 SHA512
hooverize.mus
- SHA256 6d0a23d128b5610a8ee4126d465c1b88f6a3ed865cf3774affa41d6891cf3009
- MD5 7f607bc429898669a8666115d7253386
- SHA1 5e1ad42c08108689ccd28475e899990bc3263fb7
- SHA512 2b26a64fb00efec59fc568957541463145db3d7d2e231f8192c7666e696a01be657be0d4754502658ab789373757711812f64518e82bbf0087493ca0c83c99aa
- SSDEEP 768:ZpXK6efRhFDRtbbtlgwamDpUbkXdPrNfbae7UOyl6OiaeixXhg3TUKuqGloG6NTJ:TBRLJjs8XCX
- MD5 SHA1 SHA512 SSDEEP