Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
20-08-2024 13:23
General
-
Target
Morgan.exe
-
Size
14KB
-
MD5
cd2149ef2f2c9675e75a224c10f60a8e
-
SHA1
a1a962caae493a33f947ff6412d18f864c7fc3fb
-
SHA256
17db6fd9f81222711b1f33983a8f64b8c3bddfc7dc25f4f6b6e0c6c29d877eeb
-
SHA512
0aad285dcf287da822d1e9abdb444a4c353c66f054f5828df8fd4a7ebdc41ab0e269d4171e99cfee6f4857c5859a663c8b5f0345a0395e2ee2b0ee1dbbc965aa
-
SSDEEP
192:hI/3edqmr6APSJg15CHEcWIW2g93EUY68FL8GZDAPIrIvCGmaMiDVQvr:HdPKi15Ck4W2g9UUg8GRXLuMiDVMr
Malware Config
Signatures
-
Renames multiple (295) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Morgan.exe"C:\Users\Admin\AppData\Local\Temp\Morgan.exe"1⤵
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80B
MD5cc898474cc4d56199586e8febb98478a
SHA1f43aac7aa4c5c6526129214cc83b8da6e44a173e
SHA2560ce23bad21b0cfb95c5ed9e47e42bb5c9d42e9a7de0ed340f4ebad2df30cc76c
SHA5121b4ba86d4a09705c9224d3c56449252bb0087f1a6a1744aa2743f52a97064aa168ac23b2b3ea4c70e41d9773fa854d9f3e5f6094aaf5bf83999ad318c7fa6739
-
Filesize
16B
MD518eec75dda1736dd6e82644f867d0c81
SHA148ff9e2e50fed2503334b012611436e0cad2b946
SHA256d42e91255a51968135ef51b376b6aabbc394e2fbc254c6abc9a90e465ae32519
SHA512ef84d74d34af7afa7c35653fa74a4e921767eacb5031db37c90fb1437b63eb690fee94dd21f5240ada2d1c807b3bd5db1293776ca12f371ffcb460978a7154ec
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
48KB
MD5102a8c65479752ecf05b6ffbf4c9ceed
SHA1be5cb4b42bb3050099fb6170dc62e164f606bb3b
SHA256e395f22acf54a0d81a87697a0a2ddc7611ed8874c62fb087655d93d5ec4fd9b8
SHA5126a6db56edbd4d9816b8742fa720056fc82219129ed23cb2aa744073a96b3694d1b6c31c119c281ff66fe275235651b3d5691f3d1b260c9137a515cbd68bf1066
-
Filesize
4KB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
6.9MB