Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    27/09/2024, 12:05

General

  • Target

    WinTools.net Ultimate/WinToolsVista.exe

  • Size

    2.8MB

  • MD5

    6a0539f8a24774e4594ab5659cd94410

  • SHA1

    6665fbc7cc29d441051aabf13fe6589ec33eadad

  • SHA256

    f45f703a1567d91d646d263c2eeb09c384c71ce537b40aad3143fb6df7a3ba12

  • SHA512

    f84888f47623fbf6e1ea99f7cb7e390cf74c51ca787af81e7411e099510b09764677e22556fc23fa2c780c695825cb683eca7f8d36ddcd9461014e20f12f5e09

  • SSDEEP

    49152:P8pDqa4iY1ntr8U+HWbbNiMIa3O/8cOU7m6k2yC:UokY1ntr8n2vNiMItOU7VyC

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\WinToolsVista.exe
    "C:\Users\Admin\AppData\Local\Temp\WinTools.net Ultimate\WinToolsVista.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2384-9-0x00000000023D0000-0x0000000002430000-memory.dmp

    Filesize

    384KB

  • memory/2384-8-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-7-0x0000000002630000-0x0000000002631000-memory.dmp

    Filesize

    4KB

  • memory/2384-6-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-5-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2384-4-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2384-3-0x0000000002620000-0x0000000002621000-memory.dmp

    Filesize

    4KB

  • memory/2384-2-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

  • memory/2384-1-0x0000000000210000-0x0000000000211000-memory.dmp

    Filesize

    4KB

  • memory/2384-0-0x0000000000400000-0x0000000000C1B000-memory.dmp

    Filesize

    8.1MB

  • memory/2384-11-0x0000000002610000-0x0000000002611000-memory.dmp

    Filesize

    4KB

  • memory/2384-23-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-22-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-21-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-20-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-19-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-18-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-17-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-16-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-15-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-14-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-13-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-12-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-10-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-59-0x00000000001E0000-0x00000000001E1000-memory.dmp

    Filesize

    4KB

  • memory/2384-58-0x00000000001C0000-0x00000000001C1000-memory.dmp

    Filesize

    4KB

  • memory/2384-57-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-56-0x00000000038A0000-0x00000000038A8000-memory.dmp

    Filesize

    32KB

  • memory/2384-53-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-52-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-51-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-50-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-49-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-48-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-47-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-46-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-45-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-44-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-43-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/2384-42-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-41-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-40-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-39-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-38-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-37-0x0000000002A80000-0x0000000002A81000-memory.dmp

    Filesize

    4KB

  • memory/2384-36-0x00000000038B0000-0x00000000038B1000-memory.dmp

    Filesize

    4KB

  • memory/2384-35-0x0000000002A60000-0x0000000002A61000-memory.dmp

    Filesize

    4KB

  • memory/2384-34-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/2384-33-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

  • memory/2384-32-0x0000000002A30000-0x0000000002A31000-memory.dmp

    Filesize

    4KB

  • memory/2384-31-0x0000000002A40000-0x0000000002A41000-memory.dmp

    Filesize

    4KB

  • memory/2384-30-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-29-0x00000000029F0000-0x00000000029F1000-memory.dmp

    Filesize

    4KB

  • memory/2384-28-0x0000000002660000-0x0000000002661000-memory.dmp

    Filesize

    4KB

  • memory/2384-27-0x00000000026A0000-0x00000000026A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-26-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2384-25-0x0000000002670000-0x0000000002671000-memory.dmp

    Filesize

    4KB

  • memory/2384-24-0x0000000002680000-0x0000000002681000-memory.dmp

    Filesize

    4KB

  • memory/2384-60-0x0000000000400000-0x0000000000C1B000-memory.dmp

    Filesize

    8.1MB

  • memory/2384-67-0x00000000023D0000-0x0000000002430000-memory.dmp

    Filesize

    384KB

  • memory/2384-68-0x00000000038A0000-0x00000000038A1000-memory.dmp

    Filesize

    4KB

  • memory/2384-69-0x0000000000400000-0x0000000000C1B000-memory.dmp

    Filesize

    8.1MB