Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31-10-2024 08:19
General
-
Target
4c2c6edd15d1e701c22cdf5b1dc60c45fea67979786b80851b9c044794ff1284N.exe
-
Size
558KB
-
MD5
7614ef0b5c18fefa14e29d558363fa80
-
SHA1
a814f68635e27cd299ea83db3c5d02209aa8f5e9
-
SHA256
4c2c6edd15d1e701c22cdf5b1dc60c45fea67979786b80851b9c044794ff1284
-
SHA512
cbd7bcd7802e1c49cb756a123c43ae369a10d9c04fc7042f614b412bcea526ccd13cc8832493e0321834bc0174294cb3d4d76d2f5da7f822a65816109ff0d200
-
SSDEEP
12288:21+vKnoA0cdoIl9jmDBJ4Uh2DEq/51r575O65n9V2:e+vg0HU9EP4UheEq/B79+
Malware Config
Signatures
-
Drops startup file 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c2c6edd15d1e701c22cdf5b1dc60c45fea67979786b80851b9c044794ff1284N.exe"C:\Users\Admin\AppData\Local\Temp\4c2c6edd15d1e701c22cdf5b1dc60c45fea67979786b80851b9c044794ff1284N.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\VBS3.vbs"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD52004bcee923b0e0222f4cab87c2c2a3d
SHA10a3c122b7cfe403403d913ecc1b328480b1bfc2a
SHA256f92f08df2b65e2f5b5db141c99b098c8b077c0c853a1fd51bfcc6d40dc68ad77
SHA512cae47a4dfdb942622ebca65d57e9d80c29cb299aa8c217983e34a51655c2e96ed26c7fa2fad978b6279ed4d3c8c0571e417c60152bf66a116f67d0fe38d6a445
-
Filesize
754B
MD52f5dafd443dcb8f6f5c50dd59d19801c
SHA17f3fa606272cf24583585ee4628cba682da06de9
SHA256e7e72c6bf53536b7c0d3da260d86b465c3820c93f00c5b7075bfa932a74c50ce
SHA512530ed26fc0fad8c24e9d07313d453cee845569a24925f0f0dc969ef5e1a9b5f970ac2930b86be3934d321d44ed920e9529b7bf81e6767d445fabfbaf89b1721d
-
Filesize
558KB
MD50207eb6c3d00b9f4df582d5242bd4c3c
SHA15dd199e83e1f45528c2dc769d509a26362cb651d
SHA256bc2d5c3e1149f15b745f3976d019366665aa838fa70ca835fe633c7b586f6275
SHA512f20fe91062aedc95b5a3c7092fda6cb36bf2eccaa503a9fba4cbc7685a6da2aabbf73585ecea9ebef4302e0679b477af1b77c5140c5775bf2f848bc1bf631e17
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB