Analysis
-
max time kernel
140s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
22-08-2024 01:00
General
-
Target
02ec0e970f8b832a913f2fcbeb9053b5816cd978c600061d4344b035c05aa5cf.exe
-
Size
6.2MB
-
MD5
0936dc7083dfbfcf09327552b1368b97
-
SHA1
577ab37884ffa38cbbec54c89afb24b010c9f4f2
-
SHA256
02ec0e970f8b832a913f2fcbeb9053b5816cd978c600061d4344b035c05aa5cf
-
SHA512
955f550688ddcef0caa409850c3d0eb1dea555e1790f3e1bd20358c39b30a2705ca102495dda249f000b94a0dbff53228294951ddd1df473784336dcafb007f9
-
SSDEEP
98304:IHqPmH+R2r4fFtmocc/v21KsSXLzOh69CBkvZcUf1aphMoRdKuIXBbvCw:YqOeRrQlc/AV6uh69CBhQ1ghVRd8lC
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 25 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\02ec0e970f8b832a913f2fcbeb9053b5816cd978c600061d4344b035c05aa5cf.exe"C:\Users\Admin\AppData\Local\Temp\02ec0e970f8b832a913f2fcbeb9053b5816cd978c600061d4344b035c05aa5cf.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD59eda6ac05d976773bec1a5ac2fc19c3b
SHA15885ea8e22e1d85b30e5e899c2f803c0212edccc
SHA25647cc32f966ed28e1bd719faa6ce6d2919c4d447ef784b866155796ebb410ae0a
SHA51221401d8c5336832d3603e596564065e20f178ec8cf5a983b232cdea97f1b5b55a6d3cfe141262e3680aa2caae8bcf9ec41d1db07e3d3edc243a7c308461975a9
-
Filesize
192KB
MD5df9ffe8b2b937c3316bbead7821bee5d
SHA14d6cb8554e3f9f243a775e9f9b5e107e31ebe571
SHA2564e760b339619cad772323203f2c9b4adc0c1e9b335f657afa0cb4087a036c42b
SHA5121e1cd1cbf337557333e341459f80a28cbd68e8452fca3ea844726afd19463404bb60760b1b1e8dfb881bfa8bfed6fdc77b1c31a55b8f9f63dfb9d7ad9de704fd
-
Filesize
132KB
MD53a9fff286cf967cfd251324c83bf4921
SHA1e0c90a51520ef36803469f3de79039db01cf49b9
SHA256bed9643898f91e7bcc4d551ceff435c02d71867cc5a950b0de53489e26cb2155
SHA512e772539f8f830d89797bd187dc07f1a66aea5aebcb7e8e2c569c8d53bcd19bb7deaf95c059c49c4d71dde8fdea07f0108e954b4cd966635881dc3e47bc62f4f0
-
Filesize
952KB
MD55168f1a61e75eef60cfd9b2356b2a033
SHA1ca83be6c65e002e5fdac81bc9021a3a2c88aa589
SHA2563d2d7161bda781e891c8b7609c4f3c28777b6440084be3b9dfab4b088cb496c9
SHA51247e50d390aebf028d8b9827aa078fd3cc34612190a46f8b6974b6d05cfa00fd6909c2f9fede6ef430552cb50e441d0970099d825df67ca9b462067839b00abea
-
Filesize
248KB
MD55379c9da4eecad6bd87e16fa9bf77793
SHA14952f040868210db520c15e2c948af48000da6b3
SHA256f0466700070303202910c7e7b740d3a96750b0fa8a5b5b035d789d2815d49029
SHA512a30f6a783377b932bd7c35194c883788ccde2f6040ae261d34aa22d93212a4f8184e9cf39208ddd52db23fb212a89757c1862df02bfc8ee90d61cca517485cde
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
260KB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
2.8MB
-
Filesize
1024KB
-
Filesize
6.2MB