Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 11:54

General

  • Target

    de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe

  • Size

    2.4MB

  • MD5

    dac9b9d183946c88649a4d4c1fe2a929

  • SHA1

    278a8be03b9bd20dea6db65aa3004be955d07fbc

  • SHA256

    b39c68c4aa6780541048d2449d3013f1477a5e946539766927bbe5d0c47e86d9

  • SHA512

    5051f8834a50c68facd19d309f105d21dd9746d600d95c563fd73b728551813f39b69183a3d880b2884fd0959da405d7b8470c7d245ddec4d75ae63db1a78b57

  • SSDEEP

    49152:2Ko2gzhGqxIaWeSkKkAQOQ1y7GklXRYxxTttMs+xyPFRwGJnunLp9u0XsA5cl+6M:f+zhGqx3WeSkKkAQOQ1y7PlXRYxxTtta

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 8 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry key 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe
    "C:\Users\Admin\AppData\Local\Temp\de99c475272c7a328d0198c198af6c62107449daf28e44dc0138095c3914c6b3N.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\HdVsA.bat" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Java(TM) Platform SE Auto Updator 2.1" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /f
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:2720
    • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
      "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2816
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2296
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2952
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1972
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Java\uninstall.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:292
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1636
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2016
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1316
          • C:\Windows\SysWOW64\reg.exe
            REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Falaheye.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Falaheye.exe:*:Enabled:Windows Messanger" /f
            5⤵
            • Modifies firewall policy service
            • System Location Discovery: System Language Discovery
            • Modifies registry key
            PID:2140
      • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        C:\Users\Admin\AppData\Roaming\Java\uninstall.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2788

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\HdVsA.bat

          Filesize

          173B

          MD5

          0f9512ff58185a551abc4fa80ffde3b5

          SHA1

          eb2df1adbb3504236d2857d8a9c297121c97a95d

          SHA256

          79747cbd0b884c6870d0ab8b90e4b64af598f1c1c97b2eb31c1fc1a1d6128189

          SHA512

          1f7216ce7cd2e1ae6e30c7d6d0f84b3a7a637c6cfe9568a10ffa802b99a832b3e4f45c7bd02cbbe70665e79ea917e7e9ac9a38ceaf469836fb207a47ef52ff3e

        • C:\Users\Admin\AppData\Roaming\Java\uninstall.exe

          Filesize

          2.4MB

          MD5

          472f521003985afc99b507335d6065e7

          SHA1

          cb504021d57cc2a82eb61ebe5a258dfdaefc740e

          SHA256

          f66c9486ea61c56ee2eb1fac2d2a03e259c17b8c7634d988e12f0aef52a2a34c

          SHA512

          d5c94d85e8b311f149dca30658744457b5f3c00d067d5c1652312215d141ac5f8a17fb2907e34e9d3e1be7b4ef7724c28cc5d61438393a9eed03d7729069a61d

        • memory/1232-2-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB

        • memory/1232-39-0x0000000003230000-0x000000000348F000-memory.dmp

          Filesize

          2.4MB

        • memory/1232-46-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB

        • memory/2788-61-0x00000000008E0000-0x0000000000B3F000-memory.dmp

          Filesize

          2.4MB

        • memory/2788-63-0x00000000008E0000-0x0000000000B3F000-memory.dmp

          Filesize

          2.4MB

        • memory/2788-83-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2788-52-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2788-54-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2788-58-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2788-84-0x00000000008E0000-0x0000000000B3F000-memory.dmp

          Filesize

          2.4MB

        • memory/2788-60-0x0000000000400000-0x0000000000409000-memory.dmp

          Filesize

          36KB

        • memory/2788-62-0x00000000008E0000-0x0000000000B3F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-50-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-86-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-69-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-73-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-77-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-78-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-79-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-74-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-68-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-110-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-85-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-107-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-87-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-88-0x0000000000C10000-0x0000000000E6F000-memory.dmp

          Filesize

          2.4MB

        • memory/2816-89-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-91-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-93-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-96-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-98-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-100-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-103-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2816-105-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2848-64-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB

        • memory/2848-45-0x0000000000400000-0x000000000065F000-memory.dmp

          Filesize

          2.4MB