Analysis

  • max time kernel
    27s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2024, 19:12

General

  • Target

    78f51dba7ddac2423a04b90cded3b30d1bab45b000319195553f4a3ef567969bN.exe

  • Size

    8.0MB

  • MD5

    9ef0de932ce3d3d7697726e5cefc4000

  • SHA1

    6f6f2f715fd960f18888a4992d2e5b1a6515b306

  • SHA256

    78f51dba7ddac2423a04b90cded3b30d1bab45b000319195553f4a3ef567969b

  • SHA512

    40246fc10bca1c46485ca96ea71808cd3cf1499e7a7b1157e930039826d4f7f07e7ace64ddcb1cbc5d071d255bd8be5c534b4e0838a5f01efc9351531d0c907c

  • SSDEEP

    196608:19ga6NXA/WXV4vkCpkubvhkSIuqLNDQCtOc25mUCLm0tB3meTJVTUN:19ga6NXA/WXVmThkSkLp/N25x0tBhG

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78f51dba7ddac2423a04b90cded3b30d1bab45b000319195553f4a3ef567969bN.exe
    "C:\Users\Admin\AppData\Local\Temp\78f51dba7ddac2423a04b90cded3b30d1bab45b000319195553f4a3ef567969bN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2136

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c80bc5a414ca41792a4fff3001f13077

    SHA1

    f4e9cdc9091949f1648226cf6471a4711095c907

    SHA256

    6deda447799825f3c23814bef495314f1d5057479ae5cc6eefe5effbf59f080d

    SHA512

    9f063009907b4f498676293d27bd60e91546ff0ae66c211d42af506a7c1a1b6d0b55cf94f58dd15f8f7ab89f6feb6740fcfada37c3d3da486dd5f2a29c92412d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8e4d06617477557bf2ed9aa1bfaa1544

    SHA1

    831c0b05942b01a1f7b0008b06e4225b592d21e7

    SHA256

    b4c1a0c72e93a601559e05f37a87880adca1f4418418f1fbad666005920afc64

    SHA512

    8e109e458d3b91a3285f12a955bea3059db2d4850fa59e503b4c791b43110d0940674222369c69986e3d6dfd01ca51e6e2ec1cd51799aebf39b94dddec60dbf6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66bd3786a39a30b0153f37460bc00beb

    SHA1

    37affcb69fd307069a686ffe4a1285f2ed335c61

    SHA256

    a0702a9b2b6342dd41ce373534fa83956bc858ed746d18ceaa23b4522bfaed7f

    SHA512

    a2fa05cbe518b1deecec4b8f30586982b798e8c5ad1318895f424fbed771e3f458ff2c338c5a9a8b5dbdbcf13e784caccba7a831df1a95d6d98cacb176d9aa54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    65d0e960305270b4f2ee80e1dc832051

    SHA1

    0f2fd3b9ac6823cfa4a86b2a20980b9f3e001f71

    SHA256

    3acb1954db74cfefc704ae7b0e589af2b6da84c657fd1391cf110456d9574769

    SHA512

    1d32c2c9742d9b9a7b4bbc53df6ab5d7637d155f57faf80347d8e0ed0a4976ef48334343746d76ad3eb668c5110eefa1b4ad75881c3c4507db8545c240f3ed54

  • C:\Users\Admin\AppData\Local\Temp\Cab35D2.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\SSCSettings.ini

    Filesize

    35B

    MD5

    acc41c60e92c9476ed24d62c7a740ac2

    SHA1

    522d73b2fc7ea5efb701080623262092e4eac0d1

    SHA256

    a610bdda5a25c62aeab04bbcd3cb869fa740f37a4b133fe94f1f5bde4ee34d46

    SHA512

    09f548e4fbd3eefef030aa7d8172225108cee02cd510350667de56e7cc648ffd4aa0f721d4f87def58421940ed8768005b0b63f7275acbd88a05e62eb484d162

  • C:\Users\Admin\AppData\Local\Temp\SSCSettings.ini

    Filesize

    60B

    MD5

    959d1af83e21b8ba72c93eee0130fb41

    SHA1

    6b77c1142618544324985d11a4f77d0299513f60

    SHA256

    979b87d2622b76294bf0280c0c22d6e14143bb24f007f56113a79a2db01d4b07

    SHA512

    5a96366fc9141116d2946fb7169d23d255616f430828ef17ef1dc4fc2da10f63e98a5e8c71b09fdfbd85eec214a2a5e8f30ff93000f48393320af4a64b8a485f

  • C:\Users\Admin\AppData\Local\Temp\Tar3613.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\Costura\D250A89813968ABB589A5CC82B79BB10\32\sqlite.interop.dll

    Filesize

    1.2MB

    MD5

    e6f917f1af43231e96ed6562891bfc31

    SHA1

    bdbee298d69f5a254f94766d8d7fc580f46ee5a1

    SHA256

    2e56f33cb53d989b43045c52ccacea3caf29afc54285cd3af8294b571a38389e

    SHA512

    84e36e9d9b9dac912d5912747f60bae336096080f11a6374b7ee7885c68a5b2f37193057dda71aa258dea836bfcc38b341234f40ec9c119afe85d8319d06e353

  • memory/2136-17-0x0000000006DD0000-0x0000000006E78000-memory.dmp

    Filesize

    672KB

  • memory/2136-250-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2136-15-0x00000000064F0000-0x00000000065A2000-memory.dmp

    Filesize

    712KB

  • memory/2136-10-0x0000000005C40000-0x0000000005D0E000-memory.dmp

    Filesize

    824KB

  • memory/2136-18-0x0000000006F20000-0x0000000007038000-memory.dmp

    Filesize

    1.1MB

  • memory/2136-0-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

    Filesize

    4KB

  • memory/2136-13-0x0000000000580000-0x0000000000590000-memory.dmp

    Filesize

    64KB

  • memory/2136-11-0x0000000004B00000-0x0000000004B5A000-memory.dmp

    Filesize

    360KB

  • memory/2136-127-0x00000000051A0000-0x0000000005200000-memory.dmp

    Filesize

    384KB

  • memory/2136-7-0x0000000005390000-0x000000000546E000-memory.dmp

    Filesize

    888KB

  • memory/2136-249-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

    Filesize

    4KB

  • memory/2136-14-0x0000000000C40000-0x0000000000C48000-memory.dmp

    Filesize

    32KB

  • memory/2136-8-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2136-139-0x0000000005500000-0x0000000005508000-memory.dmp

    Filesize

    32KB

  • memory/2136-9-0x0000000005DA0000-0x0000000005FF4000-memory.dmp

    Filesize

    2.3MB

  • memory/2136-12-0x0000000006150000-0x000000000622E000-memory.dmp

    Filesize

    888KB

  • memory/2136-1-0x0000000000EA0000-0x000000000169C000-memory.dmp

    Filesize

    8.0MB

  • memory/2136-521-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2136-522-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2136-594-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2136-595-0x0000000073C00000-0x00000000742EE000-memory.dmp

    Filesize

    6.9MB