Analysis
-
max time kernel
130s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 15:31
Behavioral task
behavioral1
Sample
SALE08765567800T.doc.zip
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
SALE08765567800T.doc.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
SALE08765567800T.scr
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
SALE08765567800T.scr
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20240802-en
General
-
Target
SALE08765567800T.scr
-
Size
743KB
-
MD5
e9f5c88ac891da1d0beccbd87d5e019d
-
SHA1
f967099f11090fb9f8aada10189211c98b777a0d
-
SHA256
9c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840
-
SHA512
ebdfe47786bec52aaf399b35a174a05f5840d7897f85de979953b36f1611ebfe47744ab4e74dd77eefbb28525cebd64c8bfe5948ad842460c19907c649dcdb28
-
SSDEEP
12288:COv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPidw/3SKkypQquMKAWy:Cq5TfcdHj4fmb4a3SKaoR
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Hymenophyllaceae.vbs Hymenophyllaceae.exe -
Executes dropped EXE 1 IoCs
pid Process 4724 Hymenophyllaceae.exe -
resource yara_rule behavioral4/memory/5088-0-0x0000000000120000-0x00000000002C5000-memory.dmp upx behavioral4/files/0x0004000000022f92-14.dat upx behavioral4/memory/5088-19-0x0000000000120000-0x00000000002C5000-memory.dmp upx behavioral4/memory/4724-17-0x0000000000AA0000-0x0000000000C45000-memory.dmp upx behavioral4/memory/4724-34-0x0000000000AA0000-0x0000000000C45000-memory.dmp upx -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral4/memory/5088-19-0x0000000000120000-0x00000000002C5000-memory.dmp autoit_exe behavioral4/memory/4724-34-0x0000000000AA0000-0x0000000000C45000-memory.dmp autoit_exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2308 4724 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SALE08765567800T.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Hymenophyllaceae.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 5088 SALE08765567800T.scr 5088 SALE08765567800T.scr 4724 Hymenophyllaceae.exe 4724 Hymenophyllaceae.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 5088 SALE08765567800T.scr 5088 SALE08765567800T.scr 4724 Hymenophyllaceae.exe 4724 Hymenophyllaceae.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5088 wrote to memory of 4724 5088 SALE08765567800T.scr 89 PID 5088 wrote to memory of 4724 5088 SALE08765567800T.scr 89 PID 5088 wrote to memory of 4724 5088 SALE08765567800T.scr 89 PID 4724 wrote to memory of 3124 4724 Hymenophyllaceae.exe 91 PID 4724 wrote to memory of 3124 4724 Hymenophyllaceae.exe 91 PID 4724 wrote to memory of 3124 4724 Hymenophyllaceae.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\extrorsal\Hymenophyllaceae.exe"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Windows\SysWOW64\svchost.exe"C:\Users\Admin\AppData\Local\Temp\SALE08765567800T.scr" /S3⤵PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 7243⤵
- Program crash
PID:2308
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4724 -ip 47241⤵PID:4092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD544086d7a46f74b283701e6ae5e9baee3
SHA1b0a44d968b0cb91f4f4f2b87369e3f40cbb7e3e0
SHA256f62211bd921aea032d47294694e68376002dacec12b8e6b44ebd3d9350043a15
SHA51257b094bb14ab82b26c347c01cedffcbd7cc768e8ef1ef765767393a83af950f2fc9d14df2ce3934ed6858336d6e0dff8369a5be33714dc2c70ce78fbaa0c0026
-
Filesize
743KB
MD5e9f5c88ac891da1d0beccbd87d5e019d
SHA1f967099f11090fb9f8aada10189211c98b777a0d
SHA2569c6b53051039e6e3ada670ef5c591e69e3cadae46b3e78510cadb800d2379840
SHA512ebdfe47786bec52aaf399b35a174a05f5840d7897f85de979953b36f1611ebfe47744ab4e74dd77eefbb28525cebd64c8bfe5948ad842460c19907c649dcdb28