Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
02/09/2024, 06:16
General
-
Target
ae1cfa268a4cc25b6fa6ecc734aa77d0N.exe
-
Size
1.3MB
-
MD5
ae1cfa268a4cc25b6fa6ecc734aa77d0
-
SHA1
92d8e10bc85c09f7e614916a1424e8f63a465a54
-
SHA256
ff90350b7d33bb47acdef762ad79668a93fb0273742f84833fc1cbd69172f2d9
-
SHA512
f6f8da3b4eb39b3105e5bbc2a000b55ca267826de10cc66ab1a38a178b6b1f7c89c6246515b8291115c5dbaeaf85636d5759f2837a21a0d86d2067699bc3271d
-
SSDEEP
24576:xMfWxJYVOx+5UQaotIc8nqs2L90nTv3f7YBtVpbaLcS6t3tiKE+NkT5MOJe:mfWxJYVO0re/nqBITv3kvpKng3j5CMO8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 10 IoCs
-
UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 25 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae1cfa268a4cc25b6fa6ecc734aa77d0N.exe"C:\Users\Admin\AppData\Local\Temp\ae1cfa268a4cc25b6fa6ecc734aa77d0N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\soft\GIF¼Öƹ¤¾ß.exeC:\Users\Admin\AppData\Roaming\soft\GIF¼Öƹ¤¾ß.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD54242b8a1ddf4eaff4c18f9ef11e7b365
SHA16490f4f443fb49c38466390b9f9ea373ed7b9fa7
SHA2564b2eb306298c48ae8da8d9685f0bd40a2ec18310fd1582a82d889171c114fc5d
SHA512791a09dfce20279d4d99b971f6e2688e77bd0e67cddeecde032d99c117ae301d97b42d953182768f122279d2a8acadc30603859702a05c499febccc32ca50096
-
Filesize
216KB
MD5b666d864234e2586680de95a13259829
SHA1bd6b1fa985e1bb4735c73cd6383e9c239493172a
SHA2565f22e8d6a118fe48d37b3b83980d7dc8ea37ef6385bcede770c8e493df49635f
SHA51210db4b6c571d1309502da04285b4280456bc951c5118f035a0be2a5c8800678371f4ed6754a38fe18928c2aa4f3efd685302751f7adef5f01e7952ff74f506f6
-
Filesize
188KB
MD5b925098c6a6330410cffb3994ef36211
SHA17467bb63d47ea2fa6dbf3984ede8d9e04b8ce37a
SHA256f25727ce196ac0ab4119ab7968cdfe18425170b55012fc7fb26a3f824514d82f
SHA512955ab8e3eb661cf575db0db77ca81fca16cdb3e29ce49237b1df1377d6f2aaff3c6a12bbc98a720f0a67292b39451474b97de31f696688a93547181991fffe0e
-
Filesize
1.0MB
MD5dde0681ba7a02bbb1c9b756af7e53fd2
SHA1eb1310a5848614d89e71e76bf6beee497a068017
SHA256f1efcaa3a7b5bf98819ec0076984f4af595d595c2553f4eec454e6d96f2bf080
SHA5121f9892ea5727159e7f0ec836dac78bd6923f7b803e5f39113a14c27b4bea5353503a7b998088cdf8ad0f0920e66a241c588bec0b2cab6b02157b54ab4ce30ff1
-
Filesize
76KB
MD533dc6efd3f3f23736c69ee3883edf94d
SHA157d02a0b73d48728c2b0569d32abe7ee3ac97f78
SHA25678c1a0908251f9c2ab021afd9112e6333ec1b4bb63bd1210a69e64832505ea7e
SHA5127b92c29f428d58f8124f22d0f99e523cb0a31c50669a3792190e2e94ce8e514e067797431e61593cab494f3d01d23f61b6851a0bd6839a4e756fd377653c83a1
-
Filesize
171KB
MD501f2aefd2cf91b2831d25a55f8ab9dbf
SHA1725634b3430daec1b4795c398570f8bc8d6436a3
SHA256e84be9f63c2661ac2df844b41c60164a5e948e0c0c0079b9a201d73b592ae89c
SHA512cc1efc9cda3568e61376d149858e32984adfe31de1a5ac05fc562f3758e8b7508e43068c36598fa7fd8e440881a587ac3433e2a0aaeb058d6c37734ec033f08d
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
236KB
-
Filesize
272KB
-
Filesize
244KB
-
Filesize
248KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
184KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
184KB
-
Filesize
244KB
-
Filesize
184KB