Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
11/09/2024, 11:01
General
-
Target
bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe
-
Size
5.6MB
-
MD5
9c3e3e209ceb90dfd938d2601ce97f7d
-
SHA1
3d893e8b945857d157a1012c0849b2e085e63fe7
-
SHA256
bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a
-
SHA512
b45ac76adeb70132ce8df800645131ee7dd3c43b83fa72557d7d32ccfffb7c97e0800d42743449f024b6f6431ee2fbcb02c974dc9ee77111c9cdea7dec21cd15
-
SSDEEP
98304:ExeeHncufaoTlD8AOrXQ9UR8pzePsAOmUevOshs0EOQC5oqYITMzdhHHQ82a:ExHffaoRD8AKQSe+sGUeFnEOQEofz/QQ
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Loads dropped DLL 2 IoCs
-
VMProtect packed file 11 IoCs
Detects executables packed with VMProtect commercial packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe"C:\Users\Admin\AppData\Local\Temp\bbd3f64b75d716dbeb61a7510e90a4d4249e33dd6ec3cf8ce7588a8b89eba71a.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD5b93e4dff6366cad398fa944fe30bdc48
SHA1156056d76954122703fd8bef8624c4513afc0a56
SHA25626d2948e0475bbfeb8fd453cd5c009401a79580f07f04e0b268a867f790672ee
SHA5122bdfe257925bd5f56b8e60d971424fc50f38ab90f2adecf16bc58790765c9997b3c9e8e7224fe0ef056095e721bcd5c62e1c2d7aa1c4ed537ae63acee1c4e174
-
Filesize
753B
MD565afa2a1ca3e9c97223dd6a3d9c66ca5
SHA139ae62e0d188b2118fd63f2c4fc7e38b96375229
SHA2568a2789f2635d582845b87aef13b766457ec2d4fcd63473ef802d12e4ee952681
SHA512394aa8cc13371413c1b5778d7c38c2e78e584129683c5fc0e428260d033ff5940bf8412329615f02541f2bd9216ed1ad258c42748ccaeb74b8a1e4b8991651b4
-
Filesize
5.6MB
MD568d3b3155d46172e1154c0ba77815f98
SHA18e9e81fe9dac81cb9a76a8972f834a836d2ce241
SHA25644e6aec4c48dc286b3c2a49c4bb9e53e63aea771d317635d7c2bab69dea4f8a2
SHA5121db7539eea35f23d3d7dc750e92e0094b54fd991f7a06c507d8cca24be7f0095da336adf1365c6fd0dcc01fdaab32d40ef101d2299313e98fde1a8f764fa5712
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
4KB
-
Filesize
10.2MB
-
Filesize
10.2MB
-
Filesize
10.2MB