Resubmissions

15-09-2024 23:12

240915-27aqvsxhjq 8

15-09-2024 23:02

240915-21efgaxake 8

15-09-2024 22:58

240915-2xypyaxdkj 3

15-09-2024 22:56

240915-2wn44sxcpk 3

15-09-2024 22:43

240915-2np2fawhpr 3

15-09-2024 22:42

240915-2m3k5swhmk 10

15-09-2024 22:33

240915-2gqdmawbja 8

15-09-2024 22:27

240915-2de4gswekk 7

15-09-2024 22:15

240915-16esravenh 10

Analysis

  • max time kernel
    1681s
  • max time network
    1566s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    15-09-2024 22:42

General

  • Target

    eeeeeeeeeeeeee/Malware_pack_2/Malware_pack_2/FakeActivation/[email protected]

  • Size

    396KB

  • MD5

    13f4b868603cf0dd6c32702d1bd858c9

  • SHA1

    a595ab75e134f5616679be5f11deefdfaae1de15

  • SHA256

    cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

  • SHA512

    e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

  • SSDEEP

    12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i

Malware Config

Signatures

  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\FakeActivation\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\eeeeeeeeeeeeee\Malware_pack_2\Malware_pack_2\FakeActivation\[email protected]"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3040
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2468
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1216
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2896
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2372
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2320
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2912
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1724
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2992
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2712
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2524
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2168
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2936
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2904
      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

    Filesize

    438KB

    MD5

    1bb4dd43a8aebc8f3b53acd05e31d5b5

    SHA1

    54cd1a4a505b301df636903b2293d995d560887e

    SHA256

    a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

    SHA512

    94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

    Filesize

    153KB

    MD5

    f33a4e991a11baf336a2324f700d874d

    SHA1

    9da1891a164f2fc0a88d0de1ba397585b455b0f4

    SHA256

    a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

    SHA512

    edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

  • memory/2252-27-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2468-37-0x0000000001260000-0x00000000012D4000-memory.dmp

    Filesize

    464KB

  • memory/3040-29-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

    Filesize

    4KB

  • memory/3040-30-0x00000000012F0000-0x000000000131E000-memory.dmp

    Filesize

    184KB

  • memory/3040-31-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

    Filesize

    9.9MB

  • memory/3040-32-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

    Filesize

    9.9MB

  • memory/3040-33-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

    Filesize

    4KB

  • memory/3040-34-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

    Filesize

    9.9MB