Analysis

  • max time kernel
    133s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 21:08

General

  • Target

    Flasher.zip

  • Size

    236KB

  • MD5

    4c8bbc6463c293014ebc570d8df35403

  • SHA1

    aee8b60bbd853603234a68905e268cc45152237b

  • SHA256

    646b0a869c221a54fe1f311e8576bbf9c5ee6e1e4f4f15a327115cf7951ad395

  • SHA512

    aaa15c109c4a7eacd9fac1520c16c8b2a9bdc93c9b6afd29b3145e3a74d34fd07502532f28d27edc2cd8e9384657371f82555e3dab1c2c0da956c69d463bb67d

  • SSDEEP

    6144:cezDNUPj8XIUMBhcU8CnCYXhVkcPa5NAxO2:ceXNoAYUMIUvCYRJa5NE

Score
7/10

Malware Config

Signatures

  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Flasher.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Users\Admin\AppData\Local\Temp\7zO839018F6\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\7zO839018F6\[email protected]"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2612
    • C:\Users\Admin\AppData\Local\Temp\7zO839B67A7\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\7zO839B67A7\[email protected]"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2440
    • C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2808
    • C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\[email protected]
      "C:\Users\Admin\AppData\Local\Temp\[email protected]"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2384
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x574
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3020

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\7zO839018F6\[email protected]

          Filesize

          246KB

          MD5

          9254ca1da9ff8ad492ca5fa06ca181c6

          SHA1

          70fa62e6232eae52467d29cf1c1dacb8a7aeab90

          SHA256

          30676ad5dc94c3fec3d77d87439b2bf0a1aaa7f01900b68002a06f11caee9ce6

          SHA512

          a84fbbdea4e743f3e41878b9cf6db219778f1479aa478100718af9fc8d7620fc7a3295507e11df39c7863cb896f946514e50368db480796b6603c8de5580685a

        • memory/2440-30-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB

        • memory/2440-61-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB

        • memory/2612-27-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB

        • memory/2612-38-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB

        • memory/2756-64-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB

        • memory/2808-63-0x0000000000400000-0x00000000004A4000-memory.dmp

          Filesize

          656KB