Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/09/2024, 19:22
General
-
Target
vpnclient2/28vpn_zh_5.0.exe
-
Size
660KB
-
MD5
2fb63631356b72906b35d22a27189eda
-
SHA1
dd9875906d4e8748c068ba02cfb53133720ca225
-
SHA256
82673909541b88f4f89de1cef7be87d4a2a79d74acd846322bbe8a14ed4432b8
-
SHA512
ef1d98a556fa121773dd1eb0196294d94f61d22c8a6975a2be71cb7eb79c26309635040107c6636874af0aae862d3efabc492687d0f2b511cadf9d813f0ca52a
-
SSDEEP
12288:sltPST4mIn9n/odH1vUr6SLky2W3lX/ZRduH9d7tnaWaNlCmkfqxZVzpSEHLl:sl8T4nno1crNLT2ClPZRduD74NsEZ+Er
Malware Config
Signatures
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpnclient2\28vpn_zh_5.0.exe"C:\Users\Admin\AppData\Local\Temp\vpnclient2\28vpn_zh_5.0.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD519757553b7fa97a814b4d535019e2c52
SHA1b6b1c110e256390361b3e0242f107d8da1bbbbd5
SHA2563bd28e9c48d853c0f9ff431fc29dab6f87af896f7aa564fed5797c4fb0db4c47
SHA5122ff6d31113bf8a1f1cc9c657b24761a5b87138becafe6bcde39b7354967a29aecc7a92726a77a83d7eed985d6c1e6ad655c5a1b7384f65972ec30d4c49ee80f1
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB