Analysis

  • max time kernel
    101s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/11/2024, 23:05

General

  • Target

    ca7b7b792d7885aeb2dcb34f0801e0cf3268ec54e28c0119fa6ca095a4c1bc5aN.exe

  • Size

    464KB

  • MD5

    154f308b25e8f86067b84d26a4a14800

  • SHA1

    0c8b322c1520af407af1cc6275ec4af956f9ef3f

  • SHA256

    ca7b7b792d7885aeb2dcb34f0801e0cf3268ec54e28c0119fa6ca095a4c1bc5a

  • SHA512

    783f3ee6372a1d2beac663c2a08d4e7a6d7dd0a0f90f770fa484ecee94e96df684384cb61496f8818876d0c7f4c1ebaf4074af69f77b0682cfb7ed582c385a68

  • SSDEEP

    3072:ZmyvMnbtGXRvjxCb5NgXDY7uSK4aqTB3RtoKtW9lMYwIP+XYcpyk7RKKtW9lMYwL:vzlKgzeYqTSNs6+X7jINs6+X7jFmQ

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ca7b7b792d7885aeb2dcb34f0801e0cf3268ec54e28c0119fa6ca095a4c1bc5aN.exe
    "C:\Users\Admin\AppData\Local\Temp\ca7b7b792d7885aeb2dcb34f0801e0cf3268ec54e28c0119fa6ca095a4c1bc5aN.exe"
    1⤵
    • Enumerates connected drives
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    PID:4432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files\7-Zip\7z.cab

          Filesize

          544KB

          MD5

          9a1dd1d96481d61934dcc2d568971d06

          SHA1

          f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

          SHA256

          8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

          SHA512

          7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

        • C:\Program Files\7-Zip\7z.exe

          Filesize

          503KB

          MD5

          e7780432786fa0d5fb4eab5455bd9563

          SHA1

          8b868ee23f0a13169b5dc9b7b82a36ed1ac42852

          SHA256

          bd2fb2075295125a8639802c2d6a68927b020e91a37dc3e202ca34fdc66a390d

          SHA512

          f1325d279bb9036aa39e829242e86514ded1602634c5e617d18f945aee677351a78381bc7948c5778aa8fce17d06d958c56c4ff21ef71720698b13e4013f63f8

        • C:\Program Files\7-Zip\7zFM.cab

          Filesize

          930KB

          MD5

          30ac0b832d75598fb3ec37b6f2a8c86a

          SHA1

          6f47dbfd6ff36df7ba581a4cef024da527dc3046

          SHA256

          1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

          SHA512

          505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

          Filesize

          281KB

          MD5

          3dc3594fb3b25c55081fe4b3226abbc2

          SHA1

          7eaddfd597fc76244f71f98877f7149c9e85dc9e

          SHA256

          6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e

          SHA512

          8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCXA28F.tmp

          Filesize

          236KB

          MD5

          86200feee126a11b190b5a7456c67673

          SHA1

          765378ea348efa19447f9c8a7bffba9e30e865be

          SHA256

          db2cc2e413a168bdb24e3c69343cc6ebdb3efcdc2d2ad58231af05dea50cb732

          SHA512

          781179eb92f45551da9f9990e73afa26b9546d6630a606db0f3075f106c1c070ba54ab9fb1cc6ab0e92d06aecf8e743cccf07dceb41611399788ce171bfc3e2d

        • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

          Filesize

          2.1MB

          MD5

          b8d69fa2755c3ab1f12f8866a8e2a4f7

          SHA1

          8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

          SHA256

          7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

          SHA512

          5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.cab

          Filesize

          4.0MB

          MD5

          70d3d83642c32f2434b1d7de6458d05b

          SHA1

          63b34676c8b7652af010f30f900e2dcbc95a0ab1

          SHA256

          5a37e0219828126c70be497f77dc498b856c3fa62fbfeb109448f98cdca58535

          SHA512

          656ba2fcecb0a4b5012adbed917cee121ccd7b2890b7bc85ce55c7b224951a5fbb355f6d929c47633f95eb5836451149e1d29bd164e386d12c8171c932b43d06

        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.cab

          Filesize

          1.3MB

          MD5

          a16e462f8a078e87520b56d2f48f5bd9

          SHA1

          cf22b557ee71a12f07a2af8dccb21a455feb6611

          SHA256

          eb324ee8852c09a10ad84f9542f6cbff52621dc6f75ef17d21976bcfb52f27bd

          SHA512

          022c262321cfd27c9467a940320bb35378027eb3b35fbbe252e6700d6dccabd017ec7d25c3643e1d2962d9ef7e335270987354caeef6d8e16b6ff7c0902f7c97

        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.cab

          Filesize

          1.6MB

          MD5

          b87d2e23c5eedf830fdd58858782507b

          SHA1

          77316b7bdd0a4f8c242299ba2f345c77e2bc41e2

          SHA256

          0bf621c252d90bc29e65b6cce86e5130721412e4cd133b07a6341f6d64b76f1e

          SHA512

          233302337434bb1c3b280f8a9cdcdecedbf4eb867f50d636192597ad09a4713a7ca2e3f7eca84fdd1210adaec9033f16738dbbf7901c177c858db35f6e9738cc

        • C:\Program Files\Google\Chrome\Application\chrome.cab

          Filesize

          2.6MB

          MD5

          f2e161162def9b01d0da016d5f1d8c72

          SHA1

          7240449024e742ba6ba39de5885e9bd290d8ed31

          SHA256

          f7c1b79bbd7fd294b948871fa7d6130caadf101471cb4d69185cd0e7103a1b10

          SHA512

          3bbd85522d70f5aaa02eab07a23da47ab6f36e06deab8a5a9ea63557c96fb41bf3d16c62cabcdddcb458a442754228f69532db376df5260d004547484e067758

        • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

          Filesize

          1.0MB

          MD5

          2597aa6ae97e33320dfcb968c18128b3

          SHA1

          9366e7a9c66809a7480119ef241b95fd82cb55ba

          SHA256

          09812edc4f8ab46b6d3535542b35c578bfc3da81ff56ff7148e539fcf90ef7da

          SHA512

          4999d490f3a95ba3d5a08b93dd1555969cc15b2295c8294304b19b6b55b0957bb7ef4c3a632c19998835bd8f1637b22298b897733cd910d25d13855dedf36bce

        • C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab

          Filesize

          23KB

          MD5

          f63d14c000dfcadf2394c737edaeaec9

          SHA1

          1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8

          SHA256

          ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29

          SHA512

          4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053

        • C:\Program Files\Java\jdk-1.8\bin\extcheck.cab

          Filesize

          23KB

          MD5

          952fc862806f000e37d22897243c2bc4

          SHA1

          2da507ba99d86deee0fed3238e5e9fb170a562d2

          SHA256

          955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee

          SHA512

          c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05

        • C:\Program Files\Java\jre-1.8\bin\jabswitch.cab

          Filesize

          44KB

          MD5

          f0f1575cb0a27c0815cd6a6ee694c7a1

          SHA1

          347aabf545b26e24293e7983a34a88fb1f132ed3

          SHA256

          7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae

          SHA512

          6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a

        • C:\Program Files\Java\jre-1.8\bin\java-rmi.cab

          Filesize

          23KB

          MD5

          5aab08e129caf5c4595f21142e3c32bd

          SHA1

          1ee57e2d3e4939945939d4df180c1f9128fb2582

          SHA256

          ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf

          SHA512

          5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d

        • C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab

          Filesize

          238KB

          MD5

          3f1c773a2e54f4d27b29c3fc1edd7d43

          SHA1

          ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185

          SHA256

          ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254

          SHA512

          d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297

        • C:\Program Files\Mozilla Firefox\crashreporter.cab

          Filesize

          250KB

          MD5

          aa9c1de3041eb75aeee90b85ff66c9dd

          SHA1

          83cba1e082732d95f278434fd25374104e25c668

          SHA256

          57b8145816b5d189842e350fc030e5a4def3a8990e489aa68dafec2b34e50171

          SHA512

          fa75c0de232e497540cce6f27dc0b0457860255a0822a6db297942ae91159dffaf4d35367aabcf9b2e235766a204210afee13e2e00cd0016403956a8a63a78a2

        • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

          Filesize

          33KB

          MD5

          4c6887f8c8c66f0b2db5a8b347931b70

          SHA1

          1a71320873155f84de67bc16324c8ca0e503be04

          SHA256

          a080df509685780d81ee32d86eac7ab15b5831090678f63b5741b57fd8a9969c

          SHA512

          3e1cc423bcde71a24457b5f9756241c0bc0f9b1f434eafc84ec733f124bbcf6f9a1e104caf402ef2d60a96b895842a8e6b18cffc59936e6c4873a3be92cace8f

        • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

          Filesize

          1.2MB

          MD5

          cbb81a903dc88f69ff9107f11bded306

          SHA1

          4466021a5d98b59b61c7d45a8f5dd695226b9056

          SHA256

          5719bb2ab3c985570662a12789a2dfd37acd6aa3bb743eb75fa271256455956f

          SHA512

          93e8e2e62b27686a2ca2dd4db7ae59349730e233f88ce83fd55969df1b16b9c382751987a76ba6b451bdda2dc080f7cf93a915e2517a783d16018813e3b27d13

        • C:\Program Files\dotnet\dotnet.cab

          Filesize

          143KB

          MD5

          33b4c87f18b4c49114d7a8980241657a

          SHA1

          254c67b915e45ad8584434a4af5e06ca730baa3b

          SHA256

          587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

          SHA512

          42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

        • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab

          Filesize

          56KB

          MD5

          8e4a401d4862a3ab07d4e7e17cbdfc78

          SHA1

          8ff6d2c100a2ba9b8159b9f733da011c8e448534

          SHA256

          6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2

          SHA512

          74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579

        • memory/4432-0-0x0000000000400000-0x0000000000460000-memory.dmp

          Filesize

          384KB

        • memory/4432-503-0x0000000000400000-0x0000000000460000-memory.dmp

          Filesize

          384KB