Analysis
-
max time kernel
92s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/08/2024, 02:46
General
-
Target
IMG_000071TRIAL_ORDER_CFILE.exe
-
Size
868KB
-
MD5
b21f9548581633c8878f78ffcc68ccae
-
SHA1
c9587fca5eee420675994b6365c13f934be5c718
-
SHA256
8588666e27432da27055b0ae647f5478e293da159f958a930e88a159c1dd633c
-
SHA512
6dcd4c31c74d5bdee9d2122e7b0d76ce22f1188e9c70560673f1733aa37e7b52f38cdf715639dc6be74a973f070910ace18b4cdf3aa115a3a0d03627e392f732
-
SSDEEP
24576:eJi2vF8ouL/Lad4CnoWXKPnCSiXhDYSeJz1AX:eh8oa/ctXK6SeKSj
Malware Config
Signatures
-
Loads dropped DLL 11 IoCs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG_000071TRIAL_ORDER_CFILE.exe"C:\Users\Admin\AppData\Local\Temp\IMG_000071TRIAL_ORDER_CFILE.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_000071TRIAL_ORDER_CFILE.exe"C:\Users\Admin\AppData\Local\Temp\IMG_000071TRIAL_ORDER_CFILE.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5f1e9eed02db3a822a7ddef0c724e5f1f
SHA165864992f5b6c79c5efbefb5b1354648a8a86709
SHA2566dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df
SHA512c22b64fff76b25cf53231b8636f07b361d95791c4646787ce7beac27ad6a0de88337dcceb25b5196f97c452dda72e2614647f51a8a18cb4d5228a82ed2e0780c
-
Filesize
11KB
MD517ed1c86bd67e78ade4712be48a7d2bd
SHA11cc9fe86d6d6030b4dae45ecddce5907991c01a0
SHA256bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb
SHA5120cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5
-
Filesize
988B
MD53a2553b66b5a3c84f5c9010292f87e2a
SHA19d42ceb96264f3fd13c4fc707a9fa19641bd8ff5
SHA2560eea467fbeae7f8cfb19db59b38f16f97465a91b04f1eb40f0427277053f4501
SHA5123b747320a743c56cd22da40b74a1c2257cb9d52f7ad0419dcbbfe80d2d0f9862602160148971509abd625941f153d65e08e40a26d770a582e5c3254a2ff42780
-
Filesize
1KB
MD57406e85c6d0b291a219470aa80345306
SHA1197f1d1dd5ea16579f75f5b1344ffcbe8dc254c9
SHA256e8453d4818cb607b7bbe3eeba1a0143e8fc526f15fe910ff641fe81c02e08f6e
SHA51287bc95f243c3c6ddeb256ed5ffb3f7db7370fb5f43677406fdc80d50f63cee92457dd2139b58f705735fcc903d90c44402c210eb089cd1fb70a498525427b239
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
1.1MB
-
Filesize
18.3MB
-
Filesize
12KB
-
Filesize
18.3MB
-
Filesize
18.3MB
-
Filesize
18.3MB