Resubmissions

14/11/2024, 07:49

241114-jnvykswdrn 7

13/11/2024, 21:46

241113-1m3epstjem 10

Analysis

  • max time kernel
    290s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/11/2024, 07:49

General

  • Target

    788ef6c03b347c7bf72c5c6a207ac6f362812fe728bd579b7645bc92aca4b606.exe

  • Size

    210.1MB

  • MD5

    88522a49bbbe8fa508d805bffcbf55f9

  • SHA1

    52ea90f5ef64019de5967e7e29656a8b8694f684

  • SHA256

    788ef6c03b347c7bf72c5c6a207ac6f362812fe728bd579b7645bc92aca4b606

  • SHA512

    362f93bf28fec5f991859affebfbf185bd29ae70a3cd21f711d18d420c4722750848d2cee27ce169c3537d6bee5f3aaa69fe78784d48d7cbefdcb745c9df0993

  • SSDEEP

    3145728:cQmmTrU4zKydLCpTx93/jkwLFNL7+drKngCrGv3v0oA3yS22NsJ80JABcqh:pmAzzKygp19/jJ+dOIfdA3y0sJ8Cax

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\788ef6c03b347c7bf72c5c6a207ac6f362812fe728bd579b7645bc92aca4b606.exe
    "C:\Users\Admin\AppData\Local\Temp\788ef6c03b347c7bf72c5c6a207ac6f362812fe728bd579b7645bc92aca4b606.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1952
    • C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\setup.exe
      "C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1892
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9629A863C0F0814D711B51207181FC54 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1816

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\Bin\merged.cab

          Filesize

          1.8MB

          MD5

          c5ff3a28e9fbb505ad7087246ce975eb

          SHA1

          945d82d257d2de5349b5e553602ac34e282d4c22

          SHA256

          97b1c44a59b9cd60513c61b55d977e0391fdde2c5cc21b9ff9ed75f8c390f749

          SHA512

          39c8cbd9b6ed3a192f36279c2791c6b0bd3556eeca3c5c7ebfb5b2f7da7a87cc5667691d59b4a8aae323c1abb136442979cab791ef3d00e1329cb5d6dea8d23e

        • C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\bin\nipie.exe

          Filesize

          56KB

          MD5

          97afaced2dff1b0487363ccf1fb4bfe1

          SHA1

          61f747d8c5147e65b4d9ba8bef83f6a6b3b58af6

          SHA256

          0b0aa8c40d51e2acf41df41af876cf31524a8f104575889fe6f6be8e004a1eb4

          SHA512

          1c8d2dfbbe60c1f2a02c4c7b99e1c313b088f3c5afdfc6ae12860d554df7adaf5e731efd987eb2a2ac3a7e7413fe04ac932bf90ba064343a5d6ffa55949ea3ad

        • C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\nidist.id

          Filesize

          333B

          MD5

          827fcdd358f6462a79a6c37e1e41e81e

          SHA1

          87137a04590291875615a93be67bd60062d3d888

          SHA256

          6765d23f5f954ff107d8dc773ae331090588fc63140aa9354e1c0462d3387ab5

          SHA512

          1b071bc763449291ea0ae2107e477ab98d8e5b90440a8f982fc2f3edabc7707a2970b8e3de336e92aac7992ac544fa699ae73bdbebc1d5bf9150d80b9cf1cd5a

        • C:\National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\setup.ini

          Filesize

          16KB

          MD5

          aea7cf8eeca111976ff8cb44209dbb8f

          SHA1

          94a8d39b2f4b14a338cf190d8327b723431ade6e

          SHA256

          ed4c7e6ae15a8b93af2761309a645f24bc5cbc1d4f02134fc056ddde0c7f3dae

          SHA512

          c85f57173d4196c32668470d4f165b118f7424f88b95a7efd01a9c4fbac435bed426a7f779f5ad68a664d6e4629b5564e0f0ef5fda5d9434c6b9a81bbbcdfb66

        • C:\ProgramData\National Instruments\Installation Logs\InstallationSummaryLog.xml

          Filesize

          722B

          MD5

          ab99fb1815b2928ac8e532d9b791eb96

          SHA1

          1148fa5977f6d5e0942ebd9e47e6e88a14917453

          SHA256

          9a2990334e9c4e461611b3a2e6fefe323ad3ecc40e1a3d9c55cacdabae57c8a0

          SHA512

          e68bd58025a37b9f6bbe35763dc86f782c73f92800935099dc9c87904426c3f83ffdcf1b1f8f5edc916ab1facb3995ffc47f55682185e2585d6d22ef2476ee9c

        • C:\Users\Admin\AppData\Local\Temp\MSIEB0A.tmp

          Filesize

          487KB

          MD5

          9094fea68e41f237d278e4b3e1132981

          SHA1

          5a79ff5c25f1b7e8fbf213eb9a8cbd2c59feb264

          SHA256

          11c4e79b10270ecfb63c66f77db9475b1280c7e0e22758e03870dd5448bf69af

          SHA512

          ebdc71f0acbb349beed86d0b37c6c17b1db6ab2a9f53d2a318f8e4bc93de3ceba8674a96ea2648baac6e1f3cbc2036ff74d0c10318b77ded464cf2b0668c7e94

        • C:\Users\Admin\AppData\Local\Temp\MSIEE67.tmp

          Filesize

          84KB

          MD5

          d1f4520539c80392ea62588ac7ae9cd9

          SHA1

          5ab039ead6a8b58099d970f002ea7e47342958bd

          SHA256

          178cad1dc2cae7272c8b4157dda657c1e6cf5880a964a28846de0ed7a428d1df

          SHA512

          cba04e16e3a00b7e9ca208f5599bcced93d43f46461bd85d96cc02abd7d0429fb1a0d5f41c4f3577a425956867922f455792fa0b50818e84619b523dc582df8c

        • C:\Users\Admin\AppData\Local\Temp\MSIEEE5.tmp

          Filesize

          1024KB

          MD5

          d28312bfe5f05b1bae9d23c942c5cd74

          SHA1

          d7598ad7dd48a298cd362420e06da01a19f1ef83

          SHA256

          4f3e5eefb71f9bd951147dd9c73a0aaa731b35b9a76e79aa76e990dcb7e99e72

          SHA512

          d30ad99f36d57070410dfca2a1c807fc09450940db28f80101f8e0f53d6c475653f82c7c40c08f05f1a39fc669945960b20ad4e9129283da93e73bdee81b24ae

        • C:\Users\Admin\AppData\Local\Temp\nii8386\merged.bin

          Filesize

          4.7MB

          MD5

          1bbc24e1d2b489ea8bc89dd022d267f3

          SHA1

          10e8e374d1b7474286a469d3dc145e48e62d9219

          SHA256

          93a57b53e469bb8763d799fdeddd8524dd7f38e91c6d894d41d6f17d45c9d076

          SHA512

          d8ee0f23907d5b4e3f0d1d7bea7f0417fe3dd0e42ab1517d8ae3886e78e3941d0e4bdd957cc5e9d329ee5a280f5764844a42744d2165165211c2c655773f5869

        • \National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\Bin\data0009.dll

          Filesize

          1.9MB

          MD5

          2c1ec8342660c4516737ed7433cd1896

          SHA1

          470205b85a7b38f3d1aba86885ee5a3188ead27e

          SHA256

          d790183c10d4a5ad277a45a897e7540b2ed9bfbd1de4c0babef08fe612fc6beb

          SHA512

          a8bdabfaed3bf6dbb578688988827343ce240ff9435d36502c2ebef0405581c23ea39675991b59e66a6386ec401d0e39c600d01c5da0c1afe9b3af124dc8e91d

        • \National Instruments Downloads\LabVIEW\2011f3\Run-Time Engine\Standard\setup.exe

          Filesize

          1.4MB

          MD5

          6de87d67c9f9ef771bbdaa5965338ff5

          SHA1

          8957352035000b00a15b2a281f4b10c621b5c5b9

          SHA256

          263978af3bd48ced50846e300e1770db0e77fc86c41648bec341b89eaa2f453d

          SHA512

          f41773dd11b5f9bd3ceccc541ae06dfb8c0c953b9e790e7ef9ca1b607680e96c0d83a466fc48c38ce4f4fe8e225a3106b40a97169d50031397fd73e0e4e3d2e9

        • \Users\Admin\AppData\Local\Temp\MSIED6C.tmp

          Filesize

          43KB

          MD5

          1794273d68c05960f9f63c1d3161ff46

          SHA1

          93a30b99c20c9c5d3098af33a9d1e39a3a7d2632

          SHA256

          0e98183cb6b3e86f856cee579304cd71121a37b184386bed89e73157cbaa9aa9

          SHA512

          ed1cc815d8dd4b4d16e2b6aa65385c51853aea3ac6212f096abbc5461571693d4158db49ef20c5d5c3e18aff54e70812cd35d195d0e41517f421a1e1853d14bb

        • memory/1892-282-0x00000000041F0000-0x000000000426F000-memory.dmp

          Filesize

          508KB

        • memory/1892-249-0x0000000000400000-0x0000000000904000-memory.dmp

          Filesize

          5.0MB

        • memory/1892-307-0x0000000000400000-0x0000000000904000-memory.dmp

          Filesize

          5.0MB

        • memory/1892-318-0x0000000000400000-0x0000000000904000-memory.dmp

          Filesize

          5.0MB

        • memory/1952-247-0x00000000109E0000-0x0000000010EE4000-memory.dmp

          Filesize

          5.0MB