Analysis
-
max time kernel
201s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-09-2024 23:33
General
-
Target
FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.exe
-
Size
993KB
-
MD5
e4996114d73b1bb24b7e67b034e24822
-
SHA1
d52043af823c2a6f7cb27dfd278638e4abd652b5
-
SHA256
54551f4b39f9045379c4ff93e0a8f81f2c3900b5157eeab6b41ff3f13e743372
-
SHA512
a5f67e60415450c11bc04744a45309abb0bbed4d733e3705b772d3d7d2424d2bf4f1976a4ef1b22e5a2df169f82fa2846e38fb2abd78508c3d2491201d264b7e
-
SSDEEP
12288:rSxG0wgUF888888888888W88888888888BAOeFC0bYgVa/ebO+08WLfvsvXBIJ3R:exGlPeFC0kq9IvsvXB+3HI1Vsr3Vd
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.exe"C:\Users\Admin\AppData\Local\Temp\FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L3SL8.tmp\FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.tmp"C:\Users\Admin\AppData\Local\Temp\is-L3SL8.tmp\FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.tmp" /SL5="$7004E,492628,402432,C:\Users\Admin\AppData\Local\Temp\FreemakeVideoConverterSetup_8cdef71e-1133-de5d-9d65-f79b6bde10e0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C "ver > "C:\Users\Admin\AppData\Local\Temp\is-NV5D1.tmp\~execwithresult.txt""3⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD514f5c8abebd8e51360030d1ae3137669
SHA11c72106cc170fe5b2bd20b9e59584af989fff486
SHA256c9ba417f020aef7547038326d6892d1b4967634c7bb7068ed6498e8256546d46
SHA512d575db9a4aac597751ccc5a524a8f5972298786c5f17713fc4072f2a84c0a7cade8e442c3737fb9e8879d5cd403788a638fe59821eb390b5d85e50fd9886ba32
-
Filesize
131KB
MD5ffb657374aa7751c97ef07edb00ef0c4
SHA1048fe8294f3e27c83102ca1c9f64d6de2f6c6cd0
SHA2560d114513e65753f2e261e928b59a0cd0df84cd0669b2bf75706fd04de0b817d6
SHA512eb70ddc8aab5304f911eb0fc1ea7b507b01d6870c38549ba79743f8c78d16f7e7d55868c483661005633298997f9641413cd26ebe0b1988b4695a87f653d1a29
-
Filesize
77KB
MD5b4efe1200f09cbf02f0d2ae326a84f3b
SHA183102a7f5465a14c78d04ca6d8703c68a5c599ce
SHA2566bd9984dd28ce8cc13e8eb3b5ee9f6c8a6967e3b2288918665e2ae67fa1eb56b
SHA51214c83df5ca8ce92efddb07bda1c6fff9cfbbfb1348ff6c2e6b523110bb1fd10023e09986bc7967824a5cf37789080d81f2a5deedc3df3925825f73e2a87b52a6
-
Filesize
47B
MD51a1ea0c1a7df5f91ecd62cda837a3273
SHA1f358bcfc14b04949db83e04c4e181f526b3fc5f3
SHA2569fea0616868155973e2b5ca5d1524359e47916e8aee14dfad123b533c737ee76
SHA512666a013157c5544ef7ebad000d6a5e0f2b4020bb7e7d8792880b7c35c662b1c710e25a8893f75b8599cba5bb934c18f91a689f0f24c53b287e601475b1ae9f01
-
Filesize
1.4MB
-
Filesize
96KB
-
Filesize
1.4MB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
436KB
-
Filesize
436KB