Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2024, 14:11

General

  • Target

    appFile.exe

  • Size

    820.8MB

  • MD5

    f0deb098e981d57a337c2eeb0391af38

  • SHA1

    731d91e3e09d3dc66e4a110ab8a403b4c7cd60c6

  • SHA256

    e48bd580db2bda7c3db0565a44ad11ed75e1cbf72c955aa446e01976900dd6df

  • SHA512

    869af0c641f3323226224e32475c00cb3319171ceda2e249964089eb4c262b646d7f0443bdd5366836b3130cdec3a34ac40468272acedf371842916c90a16566

  • SSDEEP

    786432:DYCgVIfeQI8jPbZIbZ+6EUmtl0IUJ+Jnc9qDYSVs8eSD4yU6yF1hu/jjz:iVIxIUzZMZ+6EH0IUn8ekFyF1g/Pz

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\appFile.exe
    "C:\Users\Admin\AppData\Local\Temp\appFile.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:336
    • C:\Users\Admin\AppData\Local\Temp\XOBIrx3RX4wPqLaiTbpG\eaUYIqD6abHXbNzeLxu3Ar3H.exe
      C:\Users\Admin\AppData\Local\Temp\XOBIrx3RX4wPqLaiTbpG\eaUYIqD6abHXbNzeLxu3Ar3H.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\is-CGLR6.tmp\is-RB4U4.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-CGLR6.tmp\is-RB4U4.tmp" /SL4 $B027A "C:\Users\Admin\AppData\Local\Temp\XOBIrx3RX4wPqLaiTbpG\eaUYIqD6abHXbNzeLxu3Ar3H.exe" 7622144 52224
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3108
        • C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe
          "C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe" -i
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2616

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe

          Filesize

          8.3MB

          MD5

          10c9c82818543db3ebead29f108bd6f6

          SHA1

          847fecb4c57ad69e5693d450d5f27bd849639943

          SHA256

          255b29ef1d13c40b6fae7951b7ca41b7f91ebf789ba52951f800990d2ac9e034

          SHA512

          8c475c738da819b584bc6f2afbc1200741300aa6bfd96b88b31014eec7576086c95e44cf9ac76295ea7deac79baf6bbbadf177a67eea28ef74902b73703ab311

        • C:\Users\Admin\AppData\Local\Temp\XOBIrx3RX4wPqLaiTbpG\eaUYIqD6abHXbNzeLxu3Ar3H.exe

          Filesize

          7.5MB

          MD5

          32a50eddc21b5e55c7a98ac0190895b7

          SHA1

          2540ac77136dd02b07ba3b593a44cc7bbff1ec1a

          SHA256

          20ae4dd835ad5eef5792b6821a380c4b3ca94767752a7d1f088e7e16bc3224b1

          SHA512

          1ca4af319fde67d57b124893324783410ca43f7ecd5bc150aaf9a77c67f16bb7d46157d37f431db7f25dd455807edb0c28a0eb0441ecd271ec65a4acbcf7d2c0

        • C:\Users\Admin\AppData\Local\Temp\is-CGLR6.tmp\is-RB4U4.tmp

          Filesize

          647KB

          MD5

          1fa266e1f8f7d0fc062b14ab5b7c1b9b

          SHA1

          ede5ec8afe07221583cb33318a9932e925b89e59

          SHA256

          abbb1a8feb63dd2b85b97a8e089d69999876c3531a68a6636a3336d9bcf3dbcb

          SHA512

          9bc95d9a26e18b585c13c69de3d3e9d41939cd7cfa5d5c07a863c5baf3f7696df9a0cc6d6264735695c849408b74e28b8749aa3bd93631ac397b7877d674341d

        • C:\Users\Admin\AppData\Local\Temp\is-GTISD.tmp\_isetup\_iscrypt.dll

          Filesize

          2KB

          MD5

          a69559718ab506675e907fe49deb71e9

          SHA1

          bc8f404ffdb1960b50c12ff9413c893b56f2e36f

          SHA256

          2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

          SHA512

          e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

        • memory/336-8-0x0000000000230000-0x0000000000C6D000-memory.dmp

          Filesize

          10.2MB

        • memory/336-7-0x0000000001510000-0x0000000001511000-memory.dmp

          Filesize

          4KB

        • memory/336-4-0x00000000014E0000-0x00000000014E1000-memory.dmp

          Filesize

          4KB

        • memory/336-6-0x0000000001500000-0x0000000001501000-memory.dmp

          Filesize

          4KB

        • memory/336-5-0x00000000014F0000-0x00000000014F1000-memory.dmp

          Filesize

          4KB

        • memory/336-12-0x0000000000301000-0x00000000006A1000-memory.dmp

          Filesize

          3.6MB

        • memory/336-13-0x0000000000230000-0x0000000000C6D000-memory.dmp

          Filesize

          10.2MB

        • memory/336-1-0x0000000001470000-0x0000000001471000-memory.dmp

          Filesize

          4KB

        • memory/336-0-0x0000000000301000-0x00000000006A1000-memory.dmp

          Filesize

          3.6MB

        • memory/336-2-0x0000000001490000-0x0000000001491000-memory.dmp

          Filesize

          4KB

        • memory/336-3-0x00000000014A0000-0x00000000014A1000-memory.dmp

          Filesize

          4KB

        • memory/2616-98-0x0000000000400000-0x0000000000C55000-memory.dmp

          Filesize

          8.3MB

        • memory/2616-99-0x0000000000400000-0x0000000000C55000-memory.dmp

          Filesize

          8.3MB

        • memory/2616-105-0x0000000000400000-0x0000000000C55000-memory.dmp

          Filesize

          8.3MB

        • memory/2616-108-0x0000000000400000-0x0000000000C55000-memory.dmp

          Filesize

          8.3MB

        • memory/2616-111-0x0000000000400000-0x0000000000C55000-memory.dmp

          Filesize

          8.3MB

        • memory/3108-26-0x0000000000400000-0x00000000004B0000-memory.dmp

          Filesize

          704KB

        • memory/3108-104-0x0000000000400000-0x00000000004B0000-memory.dmp

          Filesize

          704KB

        • memory/4700-22-0x0000000000401000-0x000000000040A000-memory.dmp

          Filesize

          36KB

        • memory/4700-19-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB

        • memory/4700-102-0x0000000000400000-0x0000000000413000-memory.dmp

          Filesize

          76KB