Analysis
-
max time kernel
118s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19/11/2024, 12:04
General
-
Target
b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.exe
-
Size
1.7MB
-
MD5
74e0b51784cbfb8e6dceaa6a5832ea50
-
SHA1
7f42b811bf293c4bce9e9903bfe3133e75f503f3
-
SHA256
b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20
-
SHA512
8c2151af85519c2f877dbc22ef475d979ce0cfc2feaacc46a17a6fd56dd5508169389800f4978a78d8bbbc2c43b30f3b93e62da9bb481b5936efb503f9ea4c45
-
SSDEEP
24576:u7FUDowAyrTVE3U5FQrVigPvdWV2oIbfyKU8L3nnf9q8Io9b86OISVJ2ei15vy:uBuZrEUqPvAfMfFf9JI8tTSaemVy
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 6 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.exe"C:\Users\Admin\AppData\Local\Temp\b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-EHMMH.tmp\b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.tmp"C:\Users\Admin\AppData\Local\Temp\is-EHMMH.tmp\b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.tmp" /SL5="$50222,869225,844288,C:\Users\Admin\AppData\Local\Temp\b56821652dc06bcbc96f123c67840d83abb7b33696be713560b21fefc4258d20N.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD525d6c5db882dcd22205ce0c0b0198845
SHA1e63768015bad4ed2c2affb13b0cb9a94a195a5cb
SHA2566be5f2712e2db7eaabac6c0f60b9cc0a1fa298de01ffe71de31a5a231f74a66c
SHA5122cd5a96e0506fee688e0fa14a20ff0f592022214bc1363b14869366aecebfdbe8930964eef0168febe5edff7ff04ec042a53b5b3fcdde76e0e95aa90b2899dbb
-
Filesize
70KB
MD5b582d76d71da0734a777fc8376fd0150
SHA1687de4b5b0844bd720619b39c65f9078ae72e7cf
SHA2561ce2b90c05299026d66af72b8d1fbf4c2abdbcbbd03959b8f05986a48f9034c6
SHA5120d9e2680bcf159446704c82c514320f76af962281dd5e5738c6e56b93c900a43bf2fc5cd5792977ae7bee5ca904774ecd0ff95dab7470901997af4fb6a666053
-
Filesize
65KB
MD5ca01cd3778c987f64633d8af840ccccb
SHA185ecea538314c4c09ce79ce554a32331d83bb4f1
SHA2563c1235a59c023bad329532d2c559350b40536ef859c00fb36425f76f348e82ab
SHA512ddb561140f22c874b35849553314e034fc4a0b792486fca09f46cba947d0438cea73f84a1775f035d0c344a9a2745a9e10f610375da4948256ee249999b21cdc
-
Filesize
47KB
MD54cfff8dc30d353cd3d215fd3a5dbac24
SHA10f4f73f0dddc75f3506e026ef53c45c6fafbc87e
SHA2560c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856
SHA5129d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
728KB
-
Filesize
876KB
-
Filesize
876KB
