Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-10-2024 06:19
General
-
Target
MLWapp2.6.x64.exe
-
Size
4.4MB
-
MD5
ae7db0dd34edccce5e267361ad44cf74
-
SHA1
56bffac7f8e9480535ddb944d9402a316c5b12ab
-
SHA256
890ebae002fb065a1e48a8f3ab513d4b23c15a52255957a2f6b521bb79f26684
-
SHA512
01b199db7900f6c7cc1e3a57138a8b0a0df9d81556fc2599de418065a980a4839cff57d76192c17eebde5c892246e1bd9ab87830f05324025303e490e3193c85
-
SSDEEP
98304:0kLcjA2zqxsQ/8WGKOk1/4kyUb4p6MV7TpYQQk90JF:DkbSsXWGKOk1/4kyUo6MVaQQ/F
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe"C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CG3K3.tmp\MLWapp2.6.x64.tmp"C:\Users\Admin\AppData\Local\Temp\is-CG3K3.tmp\MLWapp2.6.x64.tmp" /SL5="$400E0,2898546,990208,C:\Users\Admin\AppData\Local\Temp\MLWapp2.6.x64.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\MLWapp\MLWapp.exe"C:\Program Files\MLWapp\MLWapp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.6MB
MD5036a9644825a949e8afe97668474e1c6
SHA11e6ccf7a84e80a7839d761f1a13c1a8d07082927
SHA256fb787808e13769d37fa63a6b82dc09ec53537dbb60d0e7f73da824bf12d961de
SHA512aeb8dcd7b1ed57ee070629084381c1a69e43795a6af196490259da1b3f1f0c75afe525bcdca67f769a49632ac3e701351f50e5380da6bcae059859aba7116455
-
Filesize
3.2MB
MD53910bfa1391fad62f0d7a161ef178640
SHA185e292b4a80c2cfdaba75b273b47adab3fae6861
SHA25621db61b8049b6a5b7d97aa1040ceb3bb31dfdbc966e08e5b119b475be8206b2d
SHA512f4ac08bbd8b9df215d5e01eff2ff2c8471323496debe0e8a2c68b2c8bf7f6eda3fdc054630edbbe7a47809566475b9cf3480f7bec8766331d7b971a38815cd38
-
Filesize
1020KB
-
Filesize
728KB
-
Filesize
1020KB
-
Filesize
1020KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB