Analysis
-
max time kernel
135s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26/08/2024, 05:48
General
-
Target
dcPrevent_1_0_0_3 (1).rar
-
Size
29KB
-
MD5
6dfae6a04251fe8efcbd01dafd5d7101
-
SHA1
f5acad03d304f3b7ddabbdb4687d555dec9f1835
-
SHA256
296e7c4dd1b873e3a55fadc7ccd99de92273d48d298e24ffaf5e08afa9cbe0ab
-
SHA512
5abd0938ad526f3341d584b480ace01ce4bbd70cb37e8c444a6c986507b8134e8092979e863619dd4d004244acdd5f17fdce103804e254afabfb1605e0847ea5
-
SSDEEP
768:GC5TwJ7erJk5VSMs13Gq/2cHkEjhly842T7D:Z5MJ79Hscq/2cEGTy84+X
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\dcPrevent_1_0_0_3 (1).rar"1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\dcPrevent_1_0_0_3 (1)\" -spe -an -ai#7zMap10623:122:7zEvent302171⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\Desktop\dcPrevent_1_0_0_3 (1)\dcPrevent_1_0_0_3\dcPrevent.exe"C:\Users\Admin\Desktop\dcPrevent_1_0_0_3 (1)\dcPrevent_1_0_0_3\dcPrevent.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5ad422c0784a52a80ffd8ea0063f1025a
SHA117c74b6bcbe23f9ae18134c26532e0b83ce812f8
SHA2560b0d3071d24b7812fa5745c9c308eacb41cb81060721c8dc60ff765865305b5d
SHA512370f0ebfdceec3a09e5f8e13cd69473a486a050e9456aa9ac453c214a09268b548ba10899116c3d864050ca2c204b6db71ec7c968aee5b92060d5c67e64bd491
-
Filesize
337KB
MD5c4cf24bbcafd61dbd7966fcddd7245ff
SHA1678c269c8c52d9c18e89cd96e0220b4ab1f33778
SHA2568ec87466941fb8449c463f0538ddca37fe7bf55b80b22a40885b2e1768a58843
SHA51223a17a6f16975a24beeedb73c630e4439edbeeb5e1d548eaa55d89fa389adb6700e5936bb5a45e2815dae6509053345535c5057cc8aef0351b703a0032d23d48
-
Filesize
360KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
64KB