fc337884bf4752da1d78dfd1e1027e40ad98a27afd27709e6b002cd58f201c1b

Analysis

max time kernel
140s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/ashampoo-magical-security-2-2.01.exe
Size

7.1MB
MD5

04ff383c7a0632ca661d6673da9c9364
SHA1

bcfabc12223b4ef8051c10d082d58b8f54e5a11f
SHA256

2654f04e7fd70cb56d800af312856a74995f19bf777ae204b85a763b6e0ed22c
SHA512

56282d609131ea5764cfd7316810216ec80d48991560b98573a8931cdd42a465f7683863d17e2691999f6863a7dafea326d94123a985f037e2ae9c0f49a37ce0
SSDEEP

196608:gbgjeMURBOgrrwy2f4JGmJo6vrwW0aKCHk//lf/:gbgqLvwDApC6DwcKmA9n

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2380	ashampoo-magical-security-2-2.01.tmp

Loads dropped DLL 4 IoCs

pid	Process
1984	ashampoo-magical-security-2-2.01.exe
2380	ashampoo-magical-security-2-2.01.tmp
2380	ashampoo-magical-security-2-2.01.tmp
2380	ashampoo-magical-security-2-2.01.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ashampoo-magical-security-2-2.01.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ashampoo-magical-security-2-2.01.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2380	ashampoo-magical-security-2-2.01.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30
PID 1984 wrote to memory of 2380	1984	ashampoo-magical-security-2-2.01.exe	30

C:\Users\Admin\AppData\Local\Temp\$TEMP\ashampoo-magical-security-2-2.01.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\ashampoo-magical-security-2-2.01.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\is-BQ9NF.tmp\ashampoo-magical-security-2-2.01.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-BQ9NF.tmp\ashampoo-magical-security-2-2.01.tmp" /SL5="$50150,7168228,72192,C:\Users\Admin\AppData\Local\Temp\$TEMP\ashampoo-magical-security-2-2.01.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\is-B2LV9.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-B2LV9.tmp\setuphlp.dll

Filesize
44KB

MD5
3412458b4c0a6cfdd058c7d9c48c1c87

SHA1
3321cfcc9716cb0d202a6ed21c133b013df00535

SHA256
30bd0166ac21222d23c49d72b7d083d10e9a7d02521457357e2e8a544e44b936

SHA512
8fb5d6bc414766aa6fa62be6812dcb9c1cde6abcd77f302e40cad0940ed69cd25b7471318a1788af22bbe7071ecf77febb17c0609280e7666ad3d47e9d6679a5

Download Submit
\Users\Admin\AppData\Local\Temp\is-BQ9NF.tmp\ashampoo-magical-security-2-2.01.tmp

Filesize
698KB

MD5
181073e51a74b0f0834ef8a07366cb3d

SHA1
19cd10005e3073fba3193a63de5732c8045960cb

SHA256
91880a98df98bc2b249ac5ded127fe288aa2045412e4469ee06200ed8d409937

SHA512
89eb7b34899e516dae3052ef7f29b15082d0b2441d61f77301694791b9363895049e593eee2b2eae85784634c8d5d750117cd30fdab08a5baf25fa046a32c09b

Download Submit
memory/1984-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1984-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/1984-24-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/2380-9-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/2380-26-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download