Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
22/08/2024, 20:16
General
-
Target
_Unpack Portable.cmd
-
Size
1KB
-
MD5
fc1a515e9cfe7d4e74e1ccb60db4451c
-
SHA1
a9d2cadea111e58e7666abac0548e9fedc4e647b
-
SHA256
6fcc5776a0c5c731a6e681bf994e8c4705c4273927141efe805f4945784bc489
-
SHA512
7d194b1ad0f0af5f07d4d87d66dff6f661330d076f27742aafcc550aa4186d1a709af6161aea6643aff812db438d5b2a91eb9d5707be3920009ed477786bfb36
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\_Unpack Portable.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FastCopy Pro 5.2.4.exe"FastCopy Pro 5.2.4.exe" /SILENT /PORTABLE=12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-66JEK.tmp\FastCopy Pro 5.2.4.tmp"C:\Users\Admin\AppData\Local\Temp\is-66JEK.tmp\FastCopy Pro 5.2.4.tmp" /SL5="$700F4,3892970,83968,C:\Users\Admin\AppData\Local\Temp\FastCopy Pro 5.2.4.exe" /SILENT /PORTABLE=13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
394KB
MD57297d1540f06ef22daf4166ad4a7eed3
SHA10457ba3f86faf7cc584feed2ecb0760f0666601b
SHA25628353b8cbf0b74c2a6b5bd970a2f3a9993a735165601a9fcb59f1e430e390dbc
SHA512b0051c23e8c8b43794368f97f902e185afa39db4621e06e4cc911d7d9b6a761a97817da78b44dbac29dd7f8433e61f729482d42070127a996ce5c2ed89e64404
-
Filesize
268KB
MD56da42d13d2b23c20685c0c7d0ec50e63
SHA1b4d9105230241242e006241e2f9b44fef3c72455
SHA25692ece7eb60aef3f78b5ca65215c89b3a007f7c1a0de744e7dc864ece83ce2f40
SHA51206f8b50705ad63687c8976c5aed33c1818d5f1e0976da2589284617c781edd1cba03f83a4afe3bb108f8dda35c7e42a20fe77aa1c3cf67e272100c226006ae7b
-
Filesize
198KB
MD57213deba5c474acd90823216db5164d7
SHA100bea75321ec020e0d24444e6848a6a11c63f13b
SHA256d617da50fa9f571bcbdd08930779d0fac7fafcc77cb2bcdb275b9ec0c959b1a4
SHA51245a0fd5d16ef441dadae625bb44002e3333df73564c43c6636a1b5b131d87361f5e72c4fb6921951ec665b0c3abbd8d78a44b3bdd883a93838eb31927e4dc8e0
-
Filesize
138KB
MD5e6f35505e44d9779239312cb0fc7f539
SHA1d86e99649100ed86e72fab2456be6ab036a326b9
SHA256f7fd7b950f7fcc5bb8d092dc933aa926a46fe7f84eec645312cc28faef3064bd
SHA5125e94a661b7c3261d6f77e6c010399a84cbc5712a6be62164621eedcfc04c523660a6aee138bdc962fb50f7e481330a3898816219e282d1dd9b745fb30420b5c4
-
Filesize
182KB
MD529afa63b12603472ed85624dc439ec93
SHA1f2e6b4e7a6c239f041985e0e77fcfcbf96b92de7
SHA2562b18923d3bb0d60a461025490d5699958189a094903ea12bc31c09796f017e68
SHA512f02426c71eee0a8d87bddcd635f4d5e344f4ba0d716d3712606c1d26bacacf15f61460ea0c4d051532e176475783db777601b1d97e46c75d4b021a7c31f99f85
-
Filesize
2KB
MD55aed95f825f2dd5a94ec767992c4fc46
SHA17d1ffe115ae8df0d00a902bd56235db3c58ba9d6
SHA256e56b3d15b77310052598df6b0e48d76a744a1b13aa128115f6cd796f3d6a0f08
SHA512c9eab8f01252b1352d36d2306cf0bc2f76bb74131f3a2dde052063d5f834e73b4ad55ee8a501b63e08f0265732a45696ea8ee65b9c88a62b5d1cec7edaaa6ef9
-
Filesize
2KB
MD5318ac8a5b11145d62ff55b205ce42249
SHA10f02f39fa3a8270e3af2c143d5bce28cc5fcabe4
SHA256975048ecc5ae32ca6ee0032df46f0c555a6d1e261e948364e72a462f48028723
SHA51240ec1288356f0fb3b408c133ba0a6f588d18c8967ef78f85262eccbc64394b4fc757208db71f9af5ab0f8cbe515ec54da39ed3e9d90dd9380a2a3b889c368550
-
Filesize
1KB
MD59856d0d5b6d3062d97ca012157905084
SHA1573c4d9c71db95748e69ac238f69ae28cab85429
SHA25667122c49ac61c7bf865186eec5e87bd26b2ab516165026244e6e225670187ef0
SHA512f75a0202dea907102be1f5e78a5af037d6ce87d8c3b9a2f283a09c8032417c8ebfa930f6fd5c93436d128474377913bf0e04c966b5ec880bcf399cea350e3cd8
-
Filesize
1KB
MD56f3c44671e08d1b10ca0554ec367ca6e
SHA1172cf7b25f02469641f2d4e519a0d843790a1fee
SHA25652a806252d120ca61c035b8cd93adbbc71cc427f81889382c38e9d0d25bd27ff
SHA5124ec01d638ea00e022e3dcb2efcbd64db2e142f7a09345fe11cacf3876bb263b8fcf911ddd16094884be99cb19a182ca98504af205c27069d7d7d9100883377fb
-
Filesize
10KB
MD5e9f1d77b8ccbaec8865346a6a5dc659a
SHA14ba69eef604c2003c8c902a554ca22220896375a
SHA25652e2b70c71e0a6950729b3fb5610637c3946e60138314c7651d677eaba0c1a50
SHA512a63a16c93b2428244083182c094d49cac9c4daaff3caccde07dede20edea1c0f4242853750ef229a479994bb369adff2a4474f36e6f59ee1b6f5114940e8172c
-
Filesize
10KB
MD5c5d641e00adc640ea48fba399dec178b
SHA15b6fa790491ffe47e17fc836c1fd72f41c716649
SHA256c178e537323f70775cdb4fa7b4661ea6b4594dda94715656d1bf945499ae1448
SHA512272bfb86056f22d7c1b8b2da80473ada99ce9e460ed5d8cbc5d4eccdd0ffe2a5ad306ce32169363cdac9a337cdcf993da9ff28da41a4f0c957a6f9557c68f9fe
-
Filesize
10KB
MD50bc39e1cc70e5fc86e055fb0baf52d5b
SHA1830eb2551deab626c804626e10c7798447b1d041
SHA2560b709aa40b0c609510af08c14e9e050ee50d9b77eb7df64ffa00279c974f4a28
SHA5124e4396ef5c87d63f07ea11f9973a9597d808db2136a779468eb96c01e9170ea38d57327bd45bc7826b5b55ee33b8aad6196ec0473e5e26debcc2768b7852bca8
-
Filesize
10KB
MD507c180f281c8207351fd11c14468cd42
SHA12ead467c88b88d3726e613c129e49fcaffce35e5
SHA2568a961fc27b62139e231b5b3fbc3faae570c2945de26eeb7259366944ffa8f895
SHA512bcbe4ad6421fa2547a78a2d2bc096124e839dd733b5b8d4c6bc4b0185f8310b0bb1c2c82bfb466e82325d709e499eae21cdbe99f1345ed9ce117ab9566228e4e
-
Filesize
930KB
MD5f24b7b6948d14b495f67e922b2ab2fe0
SHA1cbd59fb29080b9ac604cf1a73448e22b1faf8bdd
SHA256b8b52fd9be41a2fc39cd79dc7658daa658715ce8081a93978aa0c3411ad3094b
SHA5123bf06a8e95ec5d696fc9cb07368961dee2d8407a27675b57ef0ad51d49d2b621ce1d08d2ec45aadc9b99d3ab95c408f3e68c5596374cf73336bb6d2edd0ee186
-
Filesize
66KB
MD586a1311d51c00b278cb7f27796ea442e
SHA1ac08ac9d08f8f5380e2a9a65f4117862aa861a19
SHA256e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d
SHA512129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec
-
Filesize
3.0MB
MD5b0ca93ceb050a2feff0b19e65072bbb5
SHA17ebbbbe2d2acd8fd516f824338d254a33b69f08d
SHA2560e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246
SHA51237242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
88KB
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
108KB
-
Filesize
40KB