Analysis

  • max time kernel
    126s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:20

General

  • Target

    Tut PT.5.zip

  • Size

    1.6MB

  • MD5

    e61e50420de6bd5246de04ec0a1f2fc3

  • SHA1

    022c08a5fb89d6e843823cd6abb4b31ba45495b3

  • SHA256

    831da316eb96ce781e5c7936473c08a318fd919ec985a39179550a5719ed9dfb

  • SHA512

    6549cf57d53cd48f8f3ac169926ff5639b78ec93988d8d769af4266be4daad665562abd0b1c391a6487be2d007bf889ed31c75e9eb2fc2b9e20a6a8913016f57

  • SSDEEP

    49152:h6blD9Fl34y9cDgwa9IauluAVp3z6O/8vz:EbZl34ySDla9IazAl6z

Score
3/10

Malware Config

Signatures

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Tut PT.5.zip"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7zOC28AE0C6\index.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2008
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zOC280EA27\loader.js"
      2⤵
        PID:1412
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zOC28B5897\CODES.txt
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:916
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7zOC2818658\xml.js"
        2⤵
          PID:868
      • C:\Windows\System32\fontview.exe
        "C:\Windows\System32\fontview.exe" C:\Users\Admin\Desktop\PingRestart.ttf
        1⤵
        • System Network Configuration Discovery: Internet Connection Discovery
        PID:2428

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              604f644f4b3a7484f808390f264914a5

              SHA1

              6a49769deda92b0a4946cf3b89d329a1be821698

              SHA256

              3a0d37baac98c986ccef2d184ee95b842d8fe7069e6454550a2b69609985de61

              SHA512

              fe083a29e48f374ff761141cc8687253602bc6749bdccfe0ba9c4f723c304f7ac74650659708d64fd90229eeac970103fa3763b3230e045f23563991ba3c8240

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              430262c7ee0d86da8dc46c5447600196

              SHA1

              bd203dd65f2e331be4d7f19dbb0caefac1f40e5b

              SHA256

              431bc479183943335eaac3897e456eaa5ae7cdaa1757835b0915ef7a35e3dbf9

              SHA512

              6159fc018fba8a0f15005f8c20c4206cdf92f045f095d34ff19d305c8124a1f324b293bdbe84a1e5ad70d0e8ddf7221159a476adab315437c39efee34e0d3ff6

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              284de2b3f8bba9e3a2b68853a27bdc68

              SHA1

              5d5e08cb2c8d66650629602b9e3dcea41b0b0023

              SHA256

              a583f8f640dea1777e3eeb7805a80fa98591462e9219cbf11ab6011346465441

              SHA512

              aeb3f650ac36a9c9de1e8807893eb3722cf9a8b8d8c0febf3394b2f9a10d6782d8a34d06a9de07a94a0603fb73749a81541fe877870b74f48c0e33861e693ab2

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              63e196bfc3176d57bdf599adeb4be2b6

              SHA1

              25f77c7433ae0c8492f03c465b6cea18b8e48244

              SHA256

              f90801e625a8ec0322ab450dde5f22751bacc4af0f00bf8f4db91dfdc2f4c0cf

              SHA512

              003bed04ebc703e45fa7a6642ab47cde5402ceaa82c12ab617d61fb1aa2297ca7715c503be3e52c5d46e0dead9aed0d6d18ccd430d6744d1fa253de15490253c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              f5a2d7894b8e8c36becc683734038dac

              SHA1

              5a5b30df30a1047a53f562dea7dd3913a09168bc

              SHA256

              57b13a7f4835fd73f7ca92cd7d09b98e87796e5902eae559688fcd87b364a0bf

              SHA512

              dd96e9d84c08e2e29085a911bfd41c73c73e9765167adb5ff9a431f90965e6afd1a01c7084b22000eaba25aab346e6e009717307d711b7e65c83560ca721420e

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              5655c7d467ad30acb66d44265d5b8cc2

              SHA1

              3f1c11df81e6acfe1492c2876209a388a291bc58

              SHA256

              3fb6b0e2116c4b70336719b429600562863a311eed4bdbd872bc675f1cc3c45b

              SHA512

              ba5a26b5d993a44c78d865f3a0935fb15b50afea5ff0386d866c5de687d694d1a225e81279eee226ccbc2a3be74ece0e12f14c7a30bada469efa8c97d601a4cf

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              8960476b385e13497693f4c10b0279a6

              SHA1

              17b4cd2736d7a9afb2e2647295859c28a30fc045

              SHA256

              70524d173c1621b27d7005b358e618f89a85e9562afe4427fa11550c5f893ff9

              SHA512

              7498e1fc463957e6cba3b7fff0071a7d5ee2e22ff03ab6642e87451ebbf55e2d7a7f7b010df1f8a7c8df5a83406e3ad107d7e36a5011b8af4d2bdb8af9cce9a8

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              ad50236baf9715b80d396d904278b647

              SHA1

              7a0f6c89d4887e2fc99f03a7e8fd86a36a444e4c

              SHA256

              e37eebfe63c5286d68cec71f8a0be9aa182d09dea49f170b49950c28559b1845

              SHA512

              dfa9725fbeec90e638f9d53e84e6a54fd3ebf1e6c5e8970a6cc4d79e0076f5acaa16f091e980c74c31a9a219a21187ed55d641909f916cbe1993a4e1888a46f5

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              14c7dc19845a2d39fc0f6b2653f29a9c

              SHA1

              23cac18bf79957be38eb19600d5e7c0c0c8672ee

              SHA256

              872231397b0849cad9ea75773d2df15fe2b1177b40e00fb5dd3f41ee4ea32dc7

              SHA512

              97e05d0ff4d7743f0be31687fcd4ecc92ac34e1ef66a081e63088d0917a112581dbf5397a1020afd3734826dc9a5d43796cfe93286bc6f7e33257a3cb6720f36

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              572a9356cd23d631752689c8ffc01c00

              SHA1

              70237fc845331743940102fe929a6803789b8c37

              SHA256

              915978cc1f92bb438a2da30715578f850b6d5f8e717f7ee41cbe3365fd918e26

              SHA512

              3e210811b657d13dc3e4cfbe6bfb9b84943fc79984fbbd061b6bed39205636597b9977b6b4158aadb8f836be9cec89eee09ce3526b314c0205f8dadd95a5194a

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              357203f805de8de28080970ff25cf635

              SHA1

              71f470d26cf24308d7d81c367cc1bc20aa241f6e

              SHA256

              b186f80ddbb1984ac0777faa93cc793fcaec9d51ba04f4d030fe57d8539d2ac3

              SHA512

              f9da48b9d56cb92247b6035f91c5955ccca008a7ef2e310b150192d90ae9e86687d91612f1bfdcaa8fc5bf1b74cc3409cdda5752ae8f0e6b1ea33d8d32963e0d

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              3959093a4660952df277a09452cb9d7a

              SHA1

              24fb6acfc7a4bfe8dc5ddb9b815dd697ea58fcd1

              SHA256

              b3a2f3ccb6bf9f8267cfdfcb189b757ea9249ae5edfd27bcb49e9a268df59ba9

              SHA512

              443a3e3cf574e0f0537bc39d06a54f99ceb37c2515f2c5a14ee57a8eff53a4f4812f643b4dd9726001e42e35162a4fbe317d4e63368eb05d5decdef4f7c6e1b9

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              ea441a4a3a8d42213239ad540e0dee82

              SHA1

              8466f4decffb2290213863761674b8f6422d8bdd

              SHA256

              58897b4d6a9735a2b1bb63fd6afbbb3dcbe17a2dae8db49af6165cdc1c3ec187

              SHA512

              b119073188b647fe2154d352f66d0038f4637b82ec6dd632c09c14ecd813e02e02aac77e65313570a76d6ed4452cdd467de332b527ad48b95d69a8b576279aa2

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              c840997883b0cd102ba5a3b9804f2a3e

              SHA1

              35665f03b27c46c0275cefdad94d4e10e5ce1736

              SHA256

              2ce47bb96d135a21fc7b6afe5a92f900000c29820b18f3b4b9d0a6093d1b666b

              SHA512

              92b85cefbe35a36f71acfa8b940a916839a0512f0cf78613556b7cbc37514c7b932b155cab2283798e308c2610d69c009f46a389da3572af6e32d44f593acd94

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              9271353caad08572b04701b50d6c28d0

              SHA1

              a2db05c526eba9f2bad28c4b174902ed5868eb17

              SHA256

              f653619ebb91fd5cc1d785c5074212b22d44100b09ec7e9f095c5e22f47558e0

              SHA512

              eeee85d4470cbfb7f4d911ff146dc62e023ca2e62c8eb61eb8b27e4e0428cfd44e97ed797bd2bd7a92fe3347e1c52c72662a24b239d245951a8bf6ae72772b62

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              95f03ac7c92db35e5424b0133aef662c

              SHA1

              ef6c3d99ba4c4d09bfe87781bda2ffd5d3ff9dd6

              SHA256

              80937bc517be947a54c3cb9684d2d9d9a03c1a0e713624e2570319cf0379f0a7

              SHA512

              1cdc92773c206e71488d09980d38e201d8b478961fe9f58e91ccce088b7dc024902740a998da2495897e615183c387be60bc892ac376bf2459917d82321a30e4

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              59113491ee7a480a55710ef4311130e3

              SHA1

              4d3b4da56e50c847de523f13e19c63faa78cb6d8

              SHA256

              2ef8877d072b00bc001b5eac1521382700ada01ee76c7faf8606ce1317401e7a

              SHA512

              7b0f1764a6b84cab09533af22a28e783d4c0f4b85261027b85704db9b9ae06731f82ac7cdf1e5774f1fbda70365ba64a2cb4de9be706ef2274e043e0399ab555

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              18b0198006c0804068c16c9f255ceff3

              SHA1

              efd9452dc5d9093f0938605acb8c6d1f0e1f1f61

              SHA256

              ede19b0b3f4052450274493f9a89af03980fec49ea2588692522b03cb9f5be70

              SHA512

              4f045ab08061a9d4b75b54350b9072b6eb1e5a117a7b9ae35b603c98ef789c21bb78fd561ed0624d8d792faa80a3465cd1fb166737ff21710e750312b2f5ae1c

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

              Filesize

              342B

              MD5

              81ac1a0c5b89f8c9162da5c49105fbbe

              SHA1

              f99ad7a14513b8dec6b33bca3b1fba93392be1f6

              SHA256

              7929f0250e0f34e61ca393fb485123b345f65e5ca3cdfd005d06f03e8c44f31a

              SHA512

              f08c1cb973c57bdbf3912678caeee48277b6cda73c6599f35f621d13f9efd7a3d32ab5c0b25bb235d6dfc92d2b3530777403ee99dc8a679b8982d9828d3b5827

            • C:\Users\Admin\AppData\Local\Temp\7zOC280EA27\loader.js

              Filesize

              27KB

              MD5

              8a3086f6c6298f986bda09080dd003b1

              SHA1

              8c7d41c586bfa015fb5cc50a2fdc547711b57c3c

              SHA256

              0512d9ed3e5bb3daef94aa5c16a6c3e2ee26ffed9de00d1434ffe46a027b16b9

              SHA512

              9e586742f4e19938132e41145deec584a7b8c7e111b3c6e9254f8d11db632ebe4d66898458ed7bcfc0614d06e20eb33d5a6a8eb8b32d91110557255cf1dbf017

            • C:\Users\Admin\AppData\Local\Temp\7zOC2818658\xml.js

              Filesize

              2KB

              MD5

              837efa6cbae0c226509b3f496c20660d

              SHA1

              1a6263d04cd8eea94e31583611a9c7246351482a

              SHA256

              01896b21ba9fe9106316197da8118596101b966d4597aa794720f2561cbe15d8

              SHA512

              a2787c69cd3989d239cce372fe141dde121caf8a637843413d590f4ff77941f10d8a8f8590bbfdb2255e97528289a7673e5377e469bedd8f63135ef70c12a46a

            • C:\Users\Admin\AppData\Local\Temp\7zOC28AE0C6\index.html

              Filesize

              1KB

              MD5

              b867a373e2082f0d800d1561eea8db21

              SHA1

              251a4f39dd0266a6f3ebbb87c805ac2521617b5c

              SHA256

              10b8551148fef60a1fa1c65f9ef38e4e8275ecf592b0ec6c873a41bbf37544ce

              SHA512

              c500b6bf3062c8630408d1443360e21ac9e5928970d2f523d10d2838265fb4ff6381ba92af2c245de0f8a04385c19f0730a81392a15e611cc5797e460e9839af

            • C:\Users\Admin\AppData\Local\Temp\7zOC28B5897\CODES.txt

              Filesize

              3KB

              MD5

              b61e8c32f52675a15d4f91bd13550e5e

              SHA1

              3634966ef64a37015fc7a125f1dd478f34bcc920

              SHA256

              3b1e2c242bfeceba9068ed0094e41acbf062f54bcb652b367de393951f57007d

              SHA512

              e533c2ca4006ebe8b46bdf4f4dc8dc07c3b5fc3ee04d68c9686ac859a1634aa0f042f019b08a7e13ee9b810149844feb23b9cb7f0dd7074e4b9d00c7e374f827

            • C:\Users\Admin\AppData\Local\Temp\Cab6D7.tmp

              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            • C:\Users\Admin\AppData\Local\Temp\Tar776.tmp

              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b