Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
06-09-2024 19:23
General
-
Target
mphair.exe
-
Size
1.5MB
-
MD5
aca60c7c4f24c02f4f48c0be0a5f2ce1
-
SHA1
289c97a398379b83a45f3800796b1034cbd51791
-
SHA256
36a004267f8fd8b7f0dc6e4b6f39c95e546e2c2e543813b09f221f87644aec94
-
SHA512
2663701d739753c2985f9a9557fbaacc98d5ef23c398d66f8d8d92f8085d69a01ed3c5136b4d3059bfb4a6698a4c94d4de89b6ba7b1090ed00dacb522d994410
-
SSDEEP
49152:XlOAHbVSlb8ixwI6kn9TCubHgWangeE/r2:1OybVJKWiTC2pang
Malware Config
Signatures
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Suspicious use of FindShellTrayWindow 24 IoCs
-
Suspicious use of SendNotifyMessage 16 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mphair.exe"C:\Users\Admin\AppData\Local\Temp\mphair.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5950153440f32d3bd5ab8bb2a3286d4c7
SHA1ab5295503647d198d031e041bea88dcd6ec95eec
SHA2563560b4a19ae5f390d1fa1e338ed8ca2d4ce8f671afb876df4398d21260937567
SHA512565364337c86d39c44faaad209b022ba8dcee6c9873e8a5ee7c5924226caa46e0a6ddc6fa4b371fa59216f1cba344c997eff5e2c4488ec59819afcc52a094cbf
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
5.9MB
-
Filesize
304KB