Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19/11/2024, 11:45
General
-
Target
9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.exe
-
Size
7.6MB
-
MD5
1d834d2b369d48a26bdd92e39333dbbb
-
SHA1
d85213c0f8afbf8ced43e60144a738e32121c5e0
-
SHA256
9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be
-
SHA512
c78c32c37842dcd8f31fa9b6741519907d5280e620377d935bc932133df7e53d381ecfba4c24dacb39108300376467c66601316616d1bae9de1e4465dc1af2e2
-
SSDEEP
196608:G3vs3ki3wzKysDCQDW1MfCH2/EGRYSCw4nb1pAPSmUNN:G303CzK9GQDW1sH/V4/LN
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 7 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 33 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.exe"C:\Users\Admin\AppData\Local\Temp\9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-D0EJV.tmp\9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.tmp"C:\Users\Admin\AppData\Local\Temp\is-D0EJV.tmp\9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.tmp" /SL5="$5014E,7674594,67584,C:\Users\Admin\AppData\Local\Temp\9aaee37d83d8dab2f20159835847151cce5e4e49979d21f9208b7d3c53bdc9be.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\SAF\SAFMan\safman.exe"C:\SAF\SAFMan\safman.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5ff98318064185700cf9f2bbe172ab7b3
SHA12a915d6285a5d891458b80bc2ef16eba5a38afe0
SHA2560ea2879f1999c8851db632e5bf5b8218f1a5f57f4683b23b54636a80979af6d4
SHA512d00059c8326c1171015f84d76f8439d5402a8afe6561062d43b23a4cf4b24ecf45b2f6efeb58373a14146df758e30dc21608f3f57d4b10bf3ba4f6d8ee8573c8
-
Filesize
1.5MB
MD547a775a2c4e2b8c2a6a0c422d677a23b
SHA1b71748eebc6708d6d23ced884a705e5a4e5dfe0c
SHA256c2cdb12f718735dd9924c6a25302985d790ef40a93735703c8948d7aa15d941d
SHA5123be7b020b127d7ef87fc2dcd1330bdd20e0ffaaea9aa0ceffce71f1c5e654b8d251c157c5bd609914ca2c131ba6f437cebd15ef2bebed4b5f3ed85b1495e563a
-
Filesize
1.7MB
MD56246254937b3b4bd139633c2dd1a83d4
SHA14523b017e2b1d91c471746e6bf5fb45d7a6324d6
SHA256b2b32ee08166082f9fabd13f16267ff6c30966c836fb8ffb42573803c862eb3e
SHA5124d61f87b3de658c3b785c112ecdfc63f83973b577059f940f142e969104d7419488bcf1956fc1022557c471fedff4ae261ca856729e88af46cd0c95e7a834b44
-
Filesize
722KB
MD52e6d853f3a3eadf91ff38a3391ecb2d3
SHA1c051267e36260d029233ecedadc271122653da59
SHA256ac898547b027016504bdddbd78485ed1e17e1b3120b91233527dedb8da08dd1b
SHA51235b501ee5a1e36bb91111fd2e57a216fe50eeef876a78224c3ed26d7846d80fad2f9cbac6a89953499d54c252b282baecc13cf257502cc2f3d6f99b24d6dca80
-
Filesize
16.1MB
MD5e25f67e0704e3587ad0648797d005555
SHA1367864355632d31a12f80bf82078e3695544c376
SHA2564ed3d659da514a9344b652e83b068435845c87b128e8d513e13c26fba0bb42a4
SHA5120c6af69cd1af053af1e86c819a279c0db6e2d89e675fe12d45b873b3354f73c41df9c52fe31d07fb4b1ca6865df78ea99f41ad81f2f07781b2189aa7a3bdf876
-
Filesize
10.8MB
MD5a3b919f0df1bda6bf467d9c021aa27a7
SHA19ad8e657276517230c2e0b984252b8f12ebe4b03
SHA2569cc1680bbe9adcf363662ab3c8e28bd44cc0121866a8d455b604abe84041bc38
SHA512c069ae9336bde2072aca20339759ea7bb7020e0e447c6b6750ae1a801c654a01ba9f746a75d33a27bb21558f42e89b1e000225dc5501fcb8beeddb61c1dfd396
-
Filesize
711KB
MD5a7abbbeecba21df6839d2798ef0083f9
SHA13e00cf3eb36e77b29a4594e8f117fe98300fcb85
SHA256dfb1ea29a03a9c3abeb9f87e9817b60d43cab8e3f33b8471bb10dfaaa853b84e
SHA51239819099420a3d713c9d307b9ff96bd5abaab09734640576a7e102302d32e42c3cabc6300177fac0d3b38e77afbe399019b8481baf67e1719d7e408572260050
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
1.1MB
-
Filesize
17.2MB
-
Filesize
17.2MB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
44KB
-
Filesize
92KB