ea221306b960eaf4a6fddfd974eb3ebc816835293cb5fde9df35726f205fab41

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Meinkraft.Server.DDoS.er.exe
Size

36.9MB
MD5

ed6657ce9577084b6200a5eda6acdc30
SHA1

f66db324a8fe1288ddeac1ff28eee309a7ee0b94
SHA256

ea221306b960eaf4a6fddfd974eb3ebc816835293cb5fde9df35726f205fab41
SHA512

a9c5773c570745481252df1e6db3fa228aa0fe8ff4da4fbc3ece75d93fd86e275b8b8146cfa663bf1d231774181f8be661f720947091e0c60f7b65882df1a56b
SSDEEP

786432:X00iE/44PHkNMaz/kWNCqhFLFLFLFLFLF6JaiRRbHXL:XfiTAHkNMaz/kWNjFLFLFLFLFLF6I0T7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Meinkraft.Server.DDoS.er.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Meinkraft.Server.DDoS.er.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Meinkraft.Server.DDoS.er.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1444	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1444	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1368	Meinkraft.Server.DDoS.er.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1368	Meinkraft.Server.DDoS.er.exe
1368	Meinkraft.Server.DDoS.er.exe

C:\Users\Admin\AppData\Local\Temp\Meinkraft.Server.DDoS.er.exe
"C:\Users\Admin\AppData\Local\Temp\Meinkraft.Server.DDoS.er.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1368

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x304
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx

Filesize
397B

MD5
18f13d5d50365841e15f38ff3b576470

SHA1
925af99273268c571faa7d8aec4ae16b3710fd28

SHA256
f5a513d977e777f36d61dbd5e2be3c737ade51f304a712f7955244264303adb4

SHA512
61f12376bcb1b41bd791f4b757a28241472e0857d6e25b2456d98b5d8511af1ee69a94a1d288799eb459aa6172ac63988af26694a1df4813e01b4ffa8ac1a326

Download Submit
C:\Users\Admin\AppData\Roaming\Macromedia\Flash Player\openssl\cache\RevocationCacheFile.dat

Filesize
1024B

MD5
0f343b0931126a20f133d67c2b018a3b

SHA1
60cacbf3d72e1e7834203da608037b1bf83b40e8

SHA256
5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef

SHA512
8efb4f73c5655351c444eb109230c556d39e2c7624e9c11abc9e3fb4b9b9254218cc5085b454a9698d085cfa92198491f07a723be4574adc70617b73eb0b6461

Download Submit