7d682ff0f13194b656e22976425741c4c50ee6d8dcd8b9a803f1697830acf03a

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea80a2278d0aa99f3a177400bdbbe7e0N.exe
Size

584KB
MD5

ea80a2278d0aa99f3a177400bdbbe7e0
SHA1

82758f23158fbda561efabc619f517239be2ca0d
SHA256

7d682ff0f13194b656e22976425741c4c50ee6d8dcd8b9a803f1697830acf03a
SHA512

0a03122804f8f34d55079729728bd3c1939897eb007116cbe8118f5bffe6a63c050e2d3feca2783fc6afba3dd145ac8052ac3b9463ad4566b3b0114bae800c2a
SSDEEP

12288:TT1W2sNqqOiyLKBr/vqAjwB17IdfVqVjMuvwNW3dUjve5KZ1uVF:TT1NsNpyLaDTwnIfVqGfkKRzu7

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2124	Au_.exe

Executes dropped EXE 1 IoCs

pid	Process
2124	Au_.exe

Loads dropped DLL 27 IoCs

pid	Process
1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea80a2278d0aa99f3a177400bdbbe7e0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x0008000000016210-2.dat	nsis_installer_2

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe
2124	Au_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2124	Au_.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 1800 wrote to memory of 2124	1800	ea80a2278d0aa99f3a177400bdbbe7e0N.exe	30
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31
PID 2124 wrote to memory of 1064	2124	Au_.exe	31

C:\Users\Admin\AppData\Local\Temp\ea80a2278d0aa99f3a177400bdbbe7e0N.exe
"C:\Users\Admin\AppData\Local\Temp\ea80a2278d0aa99f3a177400bdbbe7e0N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u "C:\Users\Admin\AppData\Local\Temp\PhotoMania.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PhotoManiaUninstaller_1726374404.log

Filesize
227B

MD5
8a7de96408200f9acc915fa219ed81ff

SHA1
5a6f008e7ad384c68abe049e01151c1bb3716cc3

SHA256
b7d14552e025901f653e757a7650dea2d10f3ce3010cede71d9e34e0bec03889

SHA512
04bff9b3e70f0e86679aaf3b7304380103dff525649b3c060333b9afd25b17547261ac39d964f17f17c4f470ccfc7e36a84362003135bfc4224a80fb1b0c8bd6

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\Processes.dll

Filesize
35KB

MD5
2cfba79d485cf441c646dd40d82490fc

SHA1
83e51ac1115a50986ed456bd18729653018b9619

SHA256
86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7

SHA512
cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\StdUtils.dll

Filesize
14KB

MD5
21010df9bc37daffcc0b5ae190381d85

SHA1
a8ba022aafc1233894db29e40e569dfc8b280eb9

SHA256
0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

SHA512
95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\System.dll

Filesize
11KB

MD5
00a0194c20ee912257df53bfe258ee4a

SHA1
d7b4e319bc5119024690dc8230b9cc919b1b86b2

SHA256
dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

SHA512
3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\nsislog.dll

Filesize
42KB

MD5
e47100b70748fc790ffe6299cdf7ef2d

SHA1
ad2a9cd5f7c39121926b7c131816e7ba85aeead2

SHA256
271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144

SHA512
88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB0F9.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
584KB

MD5
ea80a2278d0aa99f3a177400bdbbe7e0

SHA1
82758f23158fbda561efabc619f517239be2ca0d

SHA256
7d682ff0f13194b656e22976425741c4c50ee6d8dcd8b9a803f1697830acf03a

SHA512
0a03122804f8f34d55079729728bd3c1939897eb007116cbe8118f5bffe6a63c050e2d3feca2783fc6afba3dd145ac8052ac3b9463ad4566b3b0114bae800c2a

Download Submit
memory/1800-6-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/2124-18-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2124-111-0x0000000001F70000-0x0000000001F80000-memory.dmp

Filesize
64KB

Download
memory/2124-136-0x0000000001F70000-0x0000000001F7D000-memory.dmp

Filesize
52KB

Download
memory/2124-176-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download