Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/10/2024, 23:46
General
-
Target
HiAlbum.exe
-
Size
504KB
-
MD5
9ede30d60c7bec028989edaef0b33ba3
-
SHA1
3ef446a49063586a09dd65a080305601341d631c
-
SHA256
9820ffb7b02d723e76d42de8e7778eb01b360ef3ba07034bdb57902e5038657e
-
SHA512
af82d186219bbdf935e8b3554a841b5c29ae146189805e1e84345b76f4e54dc497108bc669f004d8988e172949a511bc8aa5e8be4a171248f26c6a0e0b5a74d3
-
SSDEEP
12288:mUXmS8sN8DAisGEHfJO+foNlk47a7dVTVTw++NUV:iD2anEHsCoNuVdwF
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HiAlbum.exe"C:\Users\Admin\AppData\Local\Temp\HiAlbum.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5bca0c3fe8eb52ef05efcd2549e6373f9
SHA1edd2c41c665eb9aa16ca6720e4193a4794de8346
SHA25604a21516ea0b198bca5b7b0e96583a653170815cc0d8526966492a62b833b928
SHA5120f57d54876ad26adbf6a7c84b0ebb490f98b69601a22e68123c6ac208963ac946b3c6707cbc000a620608fdb1ea8799131676423337439baf4a0e2959c4ecc45
-
Filesize
1.0MB
-
Filesize
220KB
-
Filesize
4KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
220KB
-
Filesize
1.0MB
-
Filesize
4KB