Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-08-2024 20:46
General
-
Target
043b765d34497785b40f0e4531963c70N.exe
-
Size
816KB
-
MD5
043b765d34497785b40f0e4531963c70
-
SHA1
68fb743ad0505c5455567807ea18fcf74d65115a
-
SHA256
a9522b9c7f2734b83dd06c2b580a5d76f37e01373ff603ace34568d249b8fc58
-
SHA512
8f49e15148236cb7a3d27a8a1ac9a7d837a049944476d4da33e2976d3090e6a6618aa0b13eb9945a5327a114cb48c18d80d9b98cda0cc8f1cf7ad5438d80cc82
-
SSDEEP
12288:MBecmJ6HYr3aFtoTYWgNzjO+ZgvgyPgd9rzK/srMdMJvMk4Cfm9uoS:MIsTF7DNu
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\043b765d34497785b40f0e4531963c70N.exe"C:\Users\Admin\AppData\Local\Temp\043b765d34497785b40f0e4531963c70N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\gO06509CaAkI06509\gO06509CaAkI06509.exe"C:\ProgramData\gO06509CaAkI06509\gO06509CaAkI06509.exe" "C:\Users\Admin\AppData\Local\Temp\043b765d34497785b40f0e4531963c70N.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD55c3a609a1a15ed14bedf70ebf5209d48
SHA16d1c42a99f7bd9ffb197b45e9a49790c52233eb2
SHA256a60fb935a99cfe96ab10dc0b0fd1b5b35342a0d4da9135953128540521e0fb09
SHA512589fda2023dbc344779dc588571292891a54aa72b7f2f9c56488ac554825531dc21e63ba7e0a28d6cd74d783c6e240b4d10871b16854521d2b3891d880a3d365
-
Filesize
816KB
MD589aa77c28996cd1bc4289e0ec08ddc61
SHA1a248ab32bbdff7387a4d95733566d2b6c931f7a2
SHA256c841ce1d6a7bbcf5a39be80cc8016730d444dd9f36ad88f96db7c25cc238811b
SHA512393d489fcff02a3c8fd667d8e266486f2b7603e6c7e9288c775ce7168badf2eee8c9416a9fd59d702e548e9e313058072d66992bfda7c08dd47b6c0a407dee6c
-
Filesize
824KB
-
Filesize
764KB
-
Filesize
660KB
-
Filesize
824KB
-
Filesize
764KB
-
Filesize
332KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB
-
Filesize
824KB