Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13/10/2024, 12:00 UTC
General
-
Target
UUSeeMediaCenter.exe
-
Size
857KB
-
MD5
dfb3cd94e260180833feeaca02434949
-
SHA1
6c7e934ac97aad0dfe985ce95cfa9216e62f0054
-
SHA256
5727cf8a4be61a49360e71b6aa7c8cc758695585aa40d0b061a6b93ab4987c0b
-
SHA512
5167340349b4749c1b31bcadee69dd94872a154e292f6f978822e86188e23403a6facae1ad1a17406d85326ae3f6c204eea603226933606b35e5c09dd9f1f1d9
-
SSDEEP
12288:oU5ZT6UuZ50vzaj+tU+yRRFAIss+xyfRojWo2qi9TOVJEQ0XkYwizbH:j29M6B9AIb+xARojWX9TqEQk
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UUSeeMediaCenter.exe"C:\Users\Admin\AppData\Local\Temp\UUSeeMediaCenter.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
-
DNScrl.microsoft.comRemote address:8.8.8.8:53Requestcrl.microsoft.comIN AResponsecrl.microsoft.comIN CNAMEcrl.www.ms.akadns.netcrl.www.ms.akadns.netIN CNAMEa1363.dscg.akamai.neta1363.dscg.akamai.netIN A2.19.117.18a1363.dscg.akamai.netIN A2.19.117.22 -
GEThttp://crl.microsoft.com/pki/crl/products/WinPCA.crlRemote address:2.19.117.18:80RequestGET /pki/crl/products/WinPCA.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
ResponseHTTP/1.1 200 OK
Content-Length: 530
Content-Type: application/pkix-crl
Content-MD5: Xiddt2GqWiOsZRr49sSgAA==
Last-Modified: Tue, 08 May 2018 21:14:18 GMT
ETag: 0x8D5B528A905E7D5
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 65de7b2c-301e-001f-024b-d9f4b4000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 13 Oct 2024 12:00:20 GMT
Connection: keep-alive
-
DNSuhms.uusee.comRemote address:8.8.8.8:53Requestuhms.uusee.comIN AResponse
-
DNSplayer.uusee.comRemote address:8.8.8.8:53Requestplayer.uusee.comIN AResponseplayer.uusee.comIN A117.78.42.51
-
DNSuhms.uusee.comRemote address:8.8.8.8:53Requestuhms.uusee.comIN AResponse
-
DNSlog.uusee.comRemote address:8.8.8.8:53Requestlog.uusee.comIN AResponse
-
DNSlogserver.uusee.comRemote address:8.8.8.8:53Requestlogserver.uusee.comIN AResponse
-
DNScrl.microsoft.comRemote address:8.8.8.8:53Requestcrl.microsoft.comIN AResponsecrl.microsoft.comIN CNAMEcrl.www.ms.akadns.netcrl.www.ms.akadns.netIN CNAMEa1363.dscg.akamai.neta1363.dscg.akamai.netIN A2.19.117.18a1363.dscg.akamai.netIN A2.19.117.22
-
GEThttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlRemote address:2.19.117.18:80RequestGET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
ResponseHTTP/1.1 200 OK
Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
ETag: 0x8DCDDD1E3AF2C76
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: b28c4ea1-d01e-0016-0ebc-0fa13d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Sun, 13 Oct 2024 12:00:51 GMT
Connection: keep-alive
-
2.19.117.18:80http://crl.microsoft.com/pki/crl/products/WinPCA.crlhttp
HTTP Request
GET http://crl.microsoft.com/pki/crl/products/WinPCA.crlHTTP Response
200 -
117.78.42.51:80player.uusee.com -
2.19.117.18:80http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlhttp
HTTP Request
GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlHTTP Response
200
-
8.8.8.8:53crl.microsoft.comdns
DNS Request
crl.microsoft.com
DNS Response
2.19.117.182.19.117.22
-
8.8.8.8:53uhms.uusee.comdns
DNS Request
uhms.uusee.com
-
8.8.8.8:53uhms.uusee.comdns
DNS Request
uhms.uusee.com
-
8.8.8.8:53player.uusee.comdns
DNS Request
player.uusee.com
DNS Response
117.78.42.51
-
8.8.8.8:53log.uusee.comdns
DNS Request
log.uusee.com
-
8.8.8.8:53logserver.uusee.comdns
DNS Request
logserver.uusee.com
-
127.0.0.1:10110 -
219.237.232.84:9800
-
219.237.232.84:9800
-
127.0.0.1:9800
-
127.0.0.1:9800
-
224.0.0.88:8000
-
8.8.8.8:53crl.microsoft.comdns
DNS Request
crl.microsoft.com
DNS Response
2.19.117.182.19.117.22
-
114.113.158.231:8000
-
219.153.56.90:8000
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD512f9325ed13880c23dea4768f2f4a88f
SHA1c1368a3ae0938f8dbf73b7b0640e9274aafa113d
SHA256f36d0f30fb8a3aa082a876db5b5b7cc9bbe36a34f0e0923d270473ed2657f675
SHA512a247a258c5697dc540713c76a76e424cca6cda31a3bf6632d7da047208bacc2d8dcc65f0264c27ef1ad4cfb71cf59e612b452ea76d8673a03fcfbb3c169c47ab
-
Filesize
204B
MD5ed0b379229602df087441a94b41a16e1
SHA12facf512948ae2414ebf61e2d142fb2e671dce21
SHA2567bde990763131a82c81fb111f735f08aef111c0f235553734f3656372f5626c2
SHA512ecf323e59a669bbfff52d1b426a2bffcd19bcd1b84b6fa185c6d2a9166b66404f4119388ce56a7516241f1b87a3695ba929a6ef7baa784d72d0d4388efe52164
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
968KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB