Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-09-2024 07:30
General
-
Target
Remittance advice.exe
-
Size
573KB
-
MD5
910da75d1c40740e17a0ab0b3eb14cf1
-
SHA1
42461054f817eaa161787deda99bb3455ed959c7
-
SHA256
815f7166e2d4007e6181aef6e1f7c82a320dfb3b84a610a065db6a3cf8982873
-
SHA512
491d75253e91e2487e8cfdbd7309fee4a13c5641c7d12d739ee23b16b3b6510bb043a79e2a8bbfcba8716aa7244fa675074973cdf5f72dd8daf837c6a7debe6d
-
SSDEEP
12288:cXe9PPlowWX0t6mOQwg1Qd15CcYk0We1FxnU4xZdmWx/P8mfVt3D34PIF:5hloDX0XOf4HZI+8QVtz34wF
Score
7/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"C:\Users\Admin\AppData\Local\Temp\Remittance advice.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
-
Filesize
16KB
-
Filesize
1.3MB