Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02-11-2024 06:17
General
-
Target
e399d1306a00d6625981ad6f3a066c12925d81bb6d5666369750bc3271f4a763.exe
-
Size
374KB
-
MD5
7d1b4a39c8df0c02355ba58bf0d3180f
-
SHA1
786b6aa3aab3714d78d81b4573530d607532f07a
-
SHA256
e399d1306a00d6625981ad6f3a066c12925d81bb6d5666369750bc3271f4a763
-
SHA512
5f334b9cfb0fc10218d14bbe549aa157b1989593d6c63dd384d96f620d6bad1ee7292cf009f4aa797c59777d07db83c1f9afc47eed5ea583a2c84309bced3461
-
SSDEEP
6144:aLcf19DQCTpV1S2GJYs7kXlQ1IR/Is7P/t1QWiT5H6TgF4G+klOEuKqYgLKrW:aAf1q6pV4jYs7kXlQ8Is7qT5H8P/OOER
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e399d1306a00d6625981ad6f3a066c12925d81bb6d5666369750bc3271f4a763.exe"C:\Users\Admin\AppData\Local\Temp\e399d1306a00d6625981ad6f3a066c12925d81bb6d5666369750bc3271f4a763.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lMc16601kEiDj16601\lMc16601kEiDj16601.exe"C:\ProgramData\lMc16601kEiDj16601\lMc16601kEiDj16601.exe" BOMBARDAMAXIMUM2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\lMc16601kEiDj16601\lMc16601kEiDj16601.exe"C:\ProgramData\lMc16601kEiDj16601\lMc16601kEiDj16601.exe" "C:\Users\Admin\AppData\Local\Temp\e399d1306a00d6625981ad6f3a066c12925d81bb6d5666369750bc3271f4a763.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD562498791d0115455dff671477b4a4f76
SHA1e39e40364ed37dfc6e2cb6c59bbb21355e7fa2b6
SHA256037aad2836722e1bef030926a525f707dd514007eb31aa319126ab2b02d5e42a
SHA512ce8d15bdc1cc378d4ec7b08eb1a3ff00e42652a9bb89ba873c838cc9b47dab5e1325fc53bdd04c3b890930becc27ab9ce1201c33efe05001330975a8cba0d28a
-
Filesize
192B
MD59f1f6acbdc2789b0a33823172b638e29
SHA1526167e7ee890c0c252f4dfc371690c100671dab
SHA256f0327edf7fb2eefc44b182c8944432c8abd7a186ce24773cd52efa7bc0e56949
SHA512864edfd8e9a2a815a27832b8bc454b1aa4177a93497d9b8e8b963b4acc255985bf9a271d055fb447c67fba8383add95ca7202dfceff23633bd70e1b651bbc830
-
Filesize
374KB
MD5d7a46463e77dd3abe88fa154550f1ea6
SHA1e1a0ef45da90748495193a6e06c11aef4960d34d
SHA256a0d76372008300087bbae7d97f4e8cc35c394190778b7f6a2f135be9f827e082
SHA512bf005fe36379d1412cb6a919d49b3e8264009fc4053d031c724f773a330feb45588f94ca2a62df1217179977a5621340ff2742afc54277366bfd608aea1c5054
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB