Analysis

  • max time kernel
    150s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 01:31

General

  • Target

    8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.exe

  • Size

    845.1MB

  • MD5

    f802845f09532b322db9bc2da6969013

  • SHA1

    5da69381bfd42de5971034ca40e8f3aee1a1406d

  • SHA256

    8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303

  • SHA512

    748ff2d15194d4ef6502e1d65aa3ad23ea1ab84192f642b34f2eca9a47de6e40eb862084879a3f655a2243e8d93b478d76445d8babc356f4837882c4bb48d679

  • SSDEEP

    25165824:Z8alpgC/DMBFMnGxk1L7hVBnmjs7FHejw5hpNRZ1ZBw:TlpgC7EFMtN9nmg7dNRjk

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 33 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.exe
    "C:\Users\Admin\AppData\Local\Temp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Users\Admin\AppData\Local\Temp\is-GV6T8.tmp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-GV6T8.tmp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.tmp" /SL5="$C01DC,885562075,192512,C:\Users\Admin\AppData\Local\Temp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\1207659483_english.jpg

    Filesize

    110KB

    MD5

    155f885e8f12be3ab9e80d281391bfd5

    SHA1

    1671932e4595c7013eb9e8194b79a5f571373561

    SHA256

    917995532f92b053b069cd906349364e1346fd54873feee446ef415e2cc012d6

    SHA512

    6e848f7486c53a519ac254f5165a6d6ce1f6837e2c036de6ffa234ce9558168c0e4786b3b9672f054d5e7e8fe75e49a8d16da7e2ca06c59184b44e6cc63a4f95

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\1441029515_english.jpg

    Filesize

    158KB

    MD5

    6258d145cb4229dfcdeb0c79a0d9db83

    SHA1

    c944a4d49fcd341f05394ae6a0a3f7712b106209

    SHA256

    a29e707a77137422f022f9756ae173711f1c8d130720a6497b148045d901b1a7

    SHA512

    0560a557ec0c50e26c43f0bc858cbb480cec7907732866654a9dc6f535c349fec669cde7fa5d582e0bbbc751a2fbf0828d5126b4df14e755cfda499500608c59

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\1456141688_english.jpg

    Filesize

    152KB

    MD5

    e5b73684a2d045f98f84d309c7192809

    SHA1

    f583ba4498f2e2411523da929bb2c705af507466

    SHA256

    be6699daecd608b4dfee79a5c5104f2915d194c6dcb3f75a4ce8010a2f3f5080

    SHA512

    dc9d34be77ca7f7fc1110458e20df762b18c3f44b247a263d39893c73a3835e5f340e8964ae1f02192d3b0aa17d9a7790e90bf23ef9f2a3ff3767893a66f38d4

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\1852354510_english.jpg

    Filesize

    137KB

    MD5

    4da7def4c3416b8520b3c876da393485

    SHA1

    cca703dca0511c028ec573de4f25650a85886dcf

    SHA256

    f60092676a53b122ab64b7d5444041f097fddcfb1263182245c5d6a5d014fc71

    SHA512

    75085fdeea8ce2ffe758ba142dc4ee231eac41fb7f86422b9c30149bc15ef9f1f1db2d46568750efc3f47c0f03da30eaf3c02c83e19a651bbf0ca25f763d5158

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\BigOK.png

    Filesize

    3KB

    MD5

    5b43a5d975a53f4fc1da67ce9f7784c1

    SHA1

    8543fa1e471030049942252b23cb22e0880c3af5

    SHA256

    59d8bb3e87a89ef523c0495addce38d69560af42aaa82f56dd41b12e6612c13a

    SHA512

    5dd5c4e9859a555a4a32da76f5231b44f7556274c6501da530b2cdd570bcb4675f710bee708322a40ed3ef9280c0d652b4e7ef0e9eaf128c08534f59291917f5

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\EULAAccepted.png

    Filesize

    2KB

    MD5

    461dfeb75927bdb39f9db5348612a611

    SHA1

    b7893b1fff6801e37ee7337d876962a09184941e

    SHA256

    0de278f5ca6d8570d9bda592268a14a28b87d3631fea2d25721947397aaab79c

    SHA512

    68528cf45c81c2c024a672f42c2cd6d4f72c015b443f103ca21deb8ee2bec4f4027490e7f33b5338a87537b5bf7f255f2828aed149f622155ec89cc81687651b

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\EULAShow.png

    Filesize

    1KB

    MD5

    c596bc9111edc702bbbb29b70984254f

    SHA1

    d4712c7b91ff4f8994e7907d31357c42eb47c738

    SHA256

    6112851daea2aaa7174e8cfac4a0f61c968bc090342503804c476eff47cc2462

    SHA512

    db50d0a39ec644873a03d64552fff1776cc94f016e8dfc8918e65aee94f7529a6de4637567b5e65c4ea988f3775785c4b52c2d96fe8dbc52b1e21ff59c737c2a

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\background.jpg

    Filesize

    317KB

    MD5

    339944ef79c977548edd93e9de6d35b8

    SHA1

    313850b3c45dda8e9ddf3e94f6ee6cb036249255

    SHA256

    463457808730f2f818c568ab59046a6b03db079499d6b3d8b8b131043c0772c4

    SHA512

    f46466f4bb7067b9e95bb17a2c9d02bde5b3e0aec661254af69101ef8c35b28b5fdd86eb2edd33fc837926d8eb48a1041fc7419da210ece8284476343a826024

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\botva2.dll

    Filesize

    35KB

    MD5

    0177746573eed407f8dca8a9e441aa49

    SHA1

    6b462adf78059d26cbc56b3311e3b97fcb8d05f7

    SHA256

    a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

    SHA512

    d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\btn_md5.png

    Filesize

    8KB

    MD5

    3befe9739354ee24a0b1ea8df05ce274

    SHA1

    ab0bda986a8c46aa19f57b75a2b7b22445a3c625

    SHA256

    b0193ab375f604fa4a25cabdea8f713babde1c07ab562ffc5679352c8e01db47

    SHA512

    ac016a59e0bfc9b22c376ae5d498c5660893a983d932b2bd502dabe032883c69e79ea8d93c2db49f95415c3cdb068e9f7d1d85527a4f9e68e065a989852d09dd

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\crcdll.dll

    Filesize

    69KB

    MD5

    1d51fac9e2384eeb674199cfd5281d7d

    SHA1

    861dfdc121357d605d0cc3793266713788109eb2

    SHA256

    23e90ce5a1f2d634a7bf5d5d0522fafeea6df9e536e16f5ce91035d5197128ec

    SHA512

    921b00adfe43b883200960e8d0958d4e6b97f6d5cfc096ee277766a3e44cc7805a20877a4edf8bd4d9102bb71a20ac218a9a512f4f76bd751d3ef14f4e0a6eda

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\error.png

    Filesize

    726B

    MD5

    df10adc25b673e74e19971c17bee5a98

    SHA1

    ee16fb1cf9491f5e611282f0574b27d76fede412

    SHA256

    142b16dc6239421691fa6e619d1a61e61176d89fa018a88b46893c29a57aad8b

    SHA512

    dc3de10e0321966cbbfb2e57b3b41da6f26dff0c7233a47469da58775b5c471e6b5181e4d4ffc81ef8b83dbcad74ccc1aad7678518f99c9185a441d2a23e010f

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\innocallback.dll

    Filesize

    63KB

    MD5

    1c55ae5ef9980e3b1028447da6105c75

    SHA1

    f85218e10e6aa23b2f5a3ed512895b437e41b45c

    SHA256

    6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f

    SHA512

    1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\ok.png

    Filesize

    1KB

    MD5

    103c1368e60806b1b7995a0894eacf87

    SHA1

    971392527f6e4b655044773132505c901a6b5469

    SHA256

    0d37d4421a39ca8852eb6760b8e914302bdc6cfcc7b170dc1b6c9bb9be148b7e

    SHA512

    652177e94438aff102f2ed873b26f0985ebed134763852b49b1ca2698463c1dbeb85152f19c8e18d397229ec5cb2cd1d17c61d454ab7c425a2cab540adc8228a

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\slideshow.ini

    Filesize

    515B

    MD5

    bad9dbc7e0c11c1428e098bad9bb90cc

    SHA1

    7b53a4be82c086016ce00b5e9580d9ef3a7fbc73

    SHA256

    b8b6a8538c1bb86f0746be187141bd5bcdbfeac058ae6a729ca8417d8beaa3db

    SHA512

    370a8ad6bb1d76afd9f68873a2ee506e0a676f26a5c2b3637dfc26f588275be1e0332918df349c525e97d462ea11a0ab69b7af96415527383ab7cde65b2fdf12

  • C:\Users\Admin\AppData\Local\Temp\is-777SS.tmp\uninstall.dll

    Filesize

    691KB

    MD5

    7db706c324cc9b6fda497d081eed6e26

    SHA1

    ca97392e573af0cf61bfa3301801a85f2beea44c

    SHA256

    cc685dbcf798549ad1a51c1dde45462e2a451ec59f48ee91219182a3871cd5b0

    SHA512

    8edf1494d57d5e708faaff4170f21f435658be897a6fe0acf243ced0701a7fd574b3c973c5bc5e8d92815e966c98977e69ac1e3083ab00c11b072115527ffa19

  • C:\Users\Admin\AppData\Local\Temp\is-GV6T8.tmp\8e1f31baf05d0854c29f257cfa99115f7e6c62577a15b6e05ff06075c5e82303.tmp

    Filesize

    1.3MB

    MD5

    bbe6d67ef2e57d463cfaf3248a969ce2

    SHA1

    9d92402975e6d83b21637967e735202900529077

    SHA256

    42068f6f50d3f00b72419ef009ecaf3cd159aeda9488054258ec179b05600201

    SHA512

    7b45b908fabce516308c3d01ec205054ee73a2bbc18120010bf88a0640929a1deb7216bffb7f9906ff71954c2c85fd6c941d9eeb299c33d57b45d9911d3a3722

  • C:\Users\Admin\Documents\eula.txt

    Filesize

    47KB

    MD5

    f3fd3cb4e19888950bbb0c412c262346

    SHA1

    c6c16e0c2dbbf2cf1945b4ba0a40021857709700

    SHA256

    151472719b9bbb31b0e0905848197ed0f1af17e4471cf57975e079560ab8845d

    SHA512

    cbe46d479cd43ffcf85d8efc002949d5eac235a94f1565a962cd33b527a95c2baaef87ce7faaed1dbc5a615048433ed18815fbce0faf52e80bb103158dc7b401

  • memory/2040-162-0x0000000002F80000-0x0000000002F8E000-memory.dmp

    Filesize

    56KB

  • memory/2040-176-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-156-0x0000000002F10000-0x0000000002F11000-memory.dmp

    Filesize

    4KB

  • memory/2040-221-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-222-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-216-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-158-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/2040-160-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-15-0x0000000005130000-0x00000000051E7000-memory.dmp

    Filesize

    732KB

  • memory/2040-161-0x0000000005130000-0x00000000051E7000-memory.dmp

    Filesize

    732KB

  • memory/2040-159-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-165-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-167-0x0000000002F80000-0x0000000002F8E000-memory.dmp

    Filesize

    56KB

  • memory/2040-164-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-171-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-170-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-177-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-60-0x0000000002F80000-0x0000000002F8E000-memory.dmp

    Filesize

    56KB

  • memory/2040-182-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-189-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-188-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-195-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-194-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-200-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-199-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-6-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/2040-205-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-206-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-211-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/2040-210-0x0000000000490000-0x00000000005E2000-memory.dmp

    Filesize

    1.3MB

  • memory/2040-217-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/4000-157-0x0000000000820000-0x0000000000859000-memory.dmp

    Filesize

    228KB

  • memory/4000-0-0x0000000000820000-0x0000000000859000-memory.dmp

    Filesize

    228KB

  • memory/4000-2-0x0000000000821000-0x0000000000832000-memory.dmp

    Filesize

    68KB