Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
31-08-2024 14:13
General
-
Target
Driver_x32.exe
-
Size
1.9MB
-
MD5
d3601e19000f0745812b600b57e10ab1
-
SHA1
b63e17df4e73234390f610769d013456c5e07131
-
SHA256
4b8390a4dcc7a6fee0e6f336f1f968863f324ca56ec597089d63ef10e9a1f9de
-
SHA512
ce8740d0ab032a80ea0f1e44162d6a2eba646adc77caaa4c5906ca6038df10e0f461259fa86282d22ebc1a1522114d78194362a9a1556180dc9a0603bae86335
-
SSDEEP
49152:etO4J7W69DooDY0W5y9wM216qN+I/8gUKMMWmeqtKicIPWC:p4u0W5y9wM216qPUj4eqt0ID
Malware Config
Signatures
-
Drops file in Windows directory 18 IoCs
-
Executes dropped EXE 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Driver_x32.exe"C:\Users\Admin\AppData\Local\Temp\Driver_x32.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\TempInst\is-59BRB.tmp\Driver_x32.tmp"C:\Windows\TempInst\is-59BRB.tmp\Driver_x32.tmp" /SL5="$601C6,1199506,180224,C:\Users\Admin\AppData\Local\Temp\Driver_x32.exe"2⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\TempInst\is-UADGC.tmp\dpinst.exe"C:\Windows\TempInst\is-UADGC.tmp\dpinst.exe" /sh /path C:\Windows\TempInst\is-UADGC.tmp3⤵
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5fbb28e3a19a6c3b65a3839887e9922d9
SHA1402bf8e1c36554655052fb5e1b45273d854f9b29
SHA25614cef8f9c08985d1f3d7ff8b6160fb36c659c0e132b3999a9e8696646269c358
SHA51242f71dba4daf1a7713ba5cc12e01a071832e7a22079f31093b16b7b345214044774476bebe9bd83a03f8798cd01de5feb218ccb53aed2ecef817eb240421922e
-
Filesize
474KB
MD57de1936b4091f44001a7fb2f7d28b62b
SHA162e350e43e78a206291c4576b2ff6feb9169a717
SHA2568ef17b69c1ca0f41b43ba4ff7a6da27a282d10a34042fe5a92612c4a6ae7979e
SHA512453ed73e732eb7ad3bed3722ebec9d47d3f5a64c59ac4b2c6533c3995d502be1a46566e8090623281a60c7277de842ce7a1036e7b2aaff69b4430e9d0fead1e9
-
Filesize
1.0MB
MD5fb098a9c1fa02d66cc3205de1e119331
SHA1f3c8d771b9d80efc233a1919a4ac07d99cba5c81
SHA2561ead8ec73312803550475c09d924dd94f080b836bd8ac57a342b49c4c17f23e7
SHA5123bea359d2debbcb33fadb4f99b2f46e7d7db0a0432360f15138dd79e8295bf4a37e8dcf0de7b61d04ea1761b6d6cc1f28854bd7afa42b155cf0ed20885fb4f19
-
Filesize
34KB
MD59f1082cb36095ae496a383ae3645567c
SHA1062d853fc1cd0b88b5c7af7bd021e304866300c7
SHA256aad2b695e6bd5a8ff57d90fb0a81b68bea29ee3982dfc2ba20aba3b04fb24e58
SHA512f9f45366d95e3681f3c268c600e4017b7be3a716fc16839e57f66405bcd257f8917db9a56050054d3df5d890b229b000c445c48bc93a1743d63c32a304f06ff8
-
Filesize
1KB
MD5ce7ae956beaa1c799681999279696127
SHA136c14575e2ff107f8ad2404df5358b92e05e3dfc
SHA256e5a2ecf2ef93946f18c2397d08e01d0beaa5c789609b11d4322832269f25227d
SHA512ad52856410ac18c7d2fd81f8540db38a6262c345449a1992f761d8f27e2a646c37a2cb69f387303614c04a929bbc5deadd5a032cfb816c9245bc1304edb433bf
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
228KB
-
Filesize
152KB
-
Filesize
228KB
-
Filesize
228KB
