Analysis
-
max time kernel
140s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13/09/2024, 19:22
General
-
Target
vpnclient2/28vpn.exe
-
Size
503KB
-
MD5
5f2553dd29553b7765c990bfcaec0117
-
SHA1
539577c585b5728d708ead08c4255543ae873503
-
SHA256
5a46384089f4391d23ed6a1016a8447ac59d135bf2c47c532533e5bf895b29e1
-
SHA512
5c585240cccf40a1ac248734b7f32eabc58d2f4f78ef275c29aa804d87a8a1bf5286c843590844aecbf4db813220a10cb502ee094f69f4736fb60a33ed2ec534
-
SSDEEP
12288:O4PIqayttu8fqYG4F2dsJ7tEgYT3jDYF616Fx4eZbKS:OJzAEcqL4FistzUE6wH4x
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpnclient2\28vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpnclient2\28vpn.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5a871986d64c7e12dbd4e5154844cd785
SHA1559f9399c378eef851c6479a6b1417fdd86c6b83
SHA2565acf248b32dfaac72ab358d1d5b5ae8f351fc4411c0c4e71728b51120aac3e01
SHA5126cff15a2784c7f695c0af822aa00bf2a060f5dc71d6b64fac4db418e06156658d890ad6cdff5a6895c98aaa5f3a97274538962204bb7ed158d32e3aa8d0aa4cb
-
Filesize
1020KB
-
Filesize
4KB
-
Filesize
1020KB
-
Filesize
4KB