Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-09-2024 12:21
General
-
Target
AimmyLauncher.exe
-
Size
161KB
-
MD5
1b61edaed8b5543cd875d3d22a219947
-
SHA1
45d0ded1b50b37063f3a0f328d56f676ccb0e519
-
SHA256
f9b275cef715b35cd5357b881bf2e62a22a6ea01a46f917cd2c072cdd2b3a18c
-
SHA512
668b3ee30fa7b2dd4a8e368f8b8eaae387f0641b2f874984e398a11141f520102568520f4fe27b6cd370b0b927f809073f9080092a413086e6f37a06de785a7b
-
SSDEEP
3072:BKta93TRDiicws0MWbs2OJiKF/ODxT5CyV9u2jNI8m5:B2wX7bJ39uyNJI
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe"C:\Users\Admin\AppData\Local\Temp\AimmyLauncher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\LaIXIz61.exe"C:\Users\Admin\AppData\Local\Temp\LaIXIz61.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD58cbf1ee5e484111cc531f7bce05fa6e8
SHA1f689edd0947a2731e56908ee247e0923b4e460dd
SHA256004a0f9c0132c480975cf879b3ed19dcee5735dccfcc162a93d898d6e78a36fe
SHA51230117db66441a97eaefccae122d1a4946336bffd83f8a3dfa489b155f3ab6994af6247eaa9ddc3325beb65baf61bdf004431b7256dd63712c146c403fc3f29cc
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB