Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-10-2024 05:01
General
-
Target
winscp-6-3-5.exe
-
Size
11.1MB
-
MD5
d77322dc956da781905d553e3feb9153
-
SHA1
89db51587ecfb071fe71add71050e2d9e5377539
-
SHA256
49e17ce8b1df637a71dfac483e9fef72f6747e4235cce3871a1bb3f3a1371127
-
SHA512
af2ec6d994f8e4fcf912cfa122136a2262991fccc46b6dc98963f83e1f8170010b3c03076b134e81b4bdb54a1d1353cfa1328afc4c206c97113929e71ef437d4
-
SSDEEP
196608:07YbPaZbS+UseezGoXBWC6KtWrFhxC7a2RfhFMdccHCxJG++ZztkrRJHpMt4eQ:tL+bpUsR/tWrzxCO21occifG+KtcNr
Malware Config
Signatures
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 62 IoCs
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winscp-6-3-5.exe"C:\Users\Admin\AppData\Local\Temp\winscp-6-3-5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-G3H4U.tmp\winscp-6-3-5.tmp"C:\Users\Admin\AppData\Local\Temp\is-G3H4U.tmp\winscp-6-3-5.tmp" /SL5="$4017E,10489221,930816,C:\Users\Admin\AppData\Local\Temp\winscp-6-3-5.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\WinSCP\DragExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\WinSCP\DragExt64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\WinSCP\WinSCP.exe"C:\Program Files (x86)\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\WinSCP\WinSCP.exe"C:\Program Files (x86)\WinSCP\WinSCP.exe" /ImportSitesIfAny3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\WinSCP\WinSCP.exe"C:\Program Files (x86)\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480KB
MD5be89ea8516602a811554df2c62c811dd
SHA1f535562499dee9830338ceb7549659655022b4b2
SHA256ab0ca9bea36ae579c28832e4f0b80a0675428adad27a5866aec220b73c73822a
SHA512af4cbe6b051efd95b999a5eaedb720c7994ae1673b928ceb762d9b76cf70e4b8cd537a2891905d054d751e6542d524fc062e29ccadbb677bb806bb962436b277
-
Filesize
6KB
MD5b16082ceeb34da39af1d52adc88be7db
SHA1b7719fec4c89fe09904ae5fecf96aa364914e57e
SHA256beee09ea768f58f29f03025984e0ce8fe4f8fd8c9cc454d9fa3869ba679f5356
SHA512bb6509a92048f4a8219ec91c9b7e75d0453ee026f91e38daab33ff7af8022f690f2e31c6b6767010ae3ae0530c854ed92a458e2c1f42d11905bb1231e32fcdf5
-
Filesize
4KB
MD52ed11efbb12a1e8de4197b5432321958
SHA1ed6add9f956866895ed2d55115f74061d8dd9b39
SHA2567e605503bc77f9fec8f5b10ee6fd1e5da273ca8b8c213985e75069a66deee649
SHA512acfbcad5dfa662f336f57db7d6975df53194faf985d1c8e874936885926fe846665c1e654026a91e6a6bec2f0ace2efc1680a17212f4278136009c5a721230c0
-
Filesize
2KB
MD54bec7ccde4a9b4881cb17a5970075988
SHA16d99f33b90547064bba5f921fc0933de35fcad33
SHA2564d2accf3e0ca1b266fc098eb88cbeaf59d9a1e5818f57aaaf57c2831da64c750
SHA512205a083de0c60c741e59c19c2bb7129d3ead4ed8a136bf851a0b32c88548f4985226f1a971522497bc40b5a09c7c439b285bfaa2100c546a3d88086a468e7561
-
Filesize
3KB
MD57b02c62423d08d7c340a530f85261534
SHA1f57fc70cac8655e1ac75abfcd83d623f83778b89
SHA256737c824e719e9e5cc43048383f8d7c7717bcb35ba37e07624c855e258d3753cf
SHA5121cee9e7ac2eea1e47dfa6d8a81b5d6ed0540db83d5280b9a4983f4dd23fba8de79a5833afba413f1bfa0189aae860079a671e18f37716b48b4d1a4f39038f663
-
Filesize
6KB
MD5afb3c633208ca9a8d7f768bf4fec30f1
SHA1912dfa1e3f0ec68869904cd2aad590f1ab35052c
SHA2561753cf7c7f64b4eb2a81540a1081e306360ace5c43e5cf47c346b8568d86f1ce
SHA512b94254bd6a5d8431017bf6938e0d29dc08f42e540c9866a3881227d3be83e90bea65b45de0b9e82529e2fe1f597ca6d0729ae9ee000bf14be95cefc9af682a4f
-
Filesize
3KB
MD5d26c1a56f63d3682da6e676b606894af
SHA1e18ed1d358dc0026ecf64f49cc5f7b4c687523c3
SHA2566b9f82c04625443346c74b907fb96d8319d22bc5a6d946fcc7a7c19c67b0757c
SHA512dffbba900e510deca45f24af1786a0cd4d5f97b6c6bd6a219bdaf74d773ed42fdbbc9490dcb457063e879d46eba047225ebf40f1110e18195d53de607b4baf07
-
Filesize
10KB
MD5680bbba778a319ba57ccc5c5c9f50c03
SHA112705a80f1be125f12a5c6e8511deccdba8bbec6
SHA256e73b3b68425691605d643e53ac729426b52168585d4b06234cfd8d592828b019
SHA51294983f38ecbc271b5452dee0777d0b669a106a0f8a9f23bfe528412ec0c75f2d249e2fb964f71d21d5bebf0f79952bf4bdc3af18f2678a2dbb32511d1259c84b
-
Filesize
2KB
MD5e4eb33335b663fc23aa03ab6ef80cb8d
SHA10db1095d82e27ef352d96a8f36ac022f035ce90d
SHA256dbdf82b86dd366dcc71edbae46f7008910e2be3f420b79e34159a81df1b39534
SHA5124f9df209721f293896c59a4db390ca2875d705625a1151f0b1481e37db6537480cf29ea1e8311dcea0643ae8e4f130efcda27d9246f8058b2765ef1b3a98138b
-
Filesize
5KB
MD567cce258db2feab972d3417ed842a1fb
SHA19e69890499496cf92092274240a2c102068d2dd9
SHA256561493f6262456b33cc46090080e26a8f6f9f1a0226649acba491ae6d2655ad6
SHA5125aa6dd2c70250559450759d42e168b66cedb22718e3e6bcc85f1abd94657db2c8305029f102047f588fce0796c9e44f04f992ec407e9b0d4bd23b2c301a98153
-
Filesize
21.9MB
MD57c743153124ba4d8ce99c7dfc77f1c06
SHA1c5612aeab0d59480bd5a7d6f9e41e0b33470ec1b
SHA2568eb7e3e8f3ee31d382359a8a232c984bdaa130584cad11683749026e5df1fdc3
SHA5128eeba7ff3f7a3cd0451cb6377db5f9542d47776b13bf96d6f9e693f4a1c6d34cbe68b12448920dea85dc3584773abe78c410e0f5803c8d149c616f47d6986cfd
-
Filesize
3.1MB
MD511878001a28ce434f6eb02aa85c3199b
SHA147dd4e5fb52236913b63d4b520775ba0685a8334
SHA256b3a2140b8ca0babc75daea00d59a3804b616b10bacf2559a3b3f510298882065
SHA5129afa2daffea483a57f0d85bce9e598792714433bcda3f100562f60066e84d5b506c79b638c20c859c80f039e4b784ad0adce6d10cf059503e624b0fb05ce5be0
-
Filesize
12B
MD5e4a1661c2c886ebb688dec494532431c
SHA1a2ae2a7db83b33dc95396607258f553114c9183c
SHA256b76875c50ef704dbbf7f02c982445971d1bbd61aebe2e4b28ddc58a1d66317d5
SHA512efdcb76fb40482bc94e37eae3701e844bf22c7d74d53aef93ac7b6ae1c1094ba2f853875d2c66a49a7075ea8c69f5a348b786d6ee0fa711669279d04adaac22c
-
Filesize
22.6MB
-
Filesize
22.6MB
-
Filesize
728KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
22.6MB
-
Filesize
22.6MB
-
Filesize
22.6MB