Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
21-11-2024 23:54
General
-
Target
1732233184b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc512.dat-decoded.exe
-
Size
64KB
-
MD5
385e7b496b00ea29de872509cb29f5be
-
SHA1
5d944b9957d54698cb0319a3e65362435ef5885b
-
SHA256
8169d73b40ee6e81a7ab0bae2f3d761102d03877385d0fd2c26f972e9210ada9
-
SHA512
9fa0973186c1577dea242a0df9b0a23c416da33e7a7f232678669fb0479ca4eec83a0ee21e97c6ce0768e461348740edfdcaefb3324e1572810f493e618c8ba2
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIh:8g585LpPCrQt7F84IIIIIIIIIIIIIIIz
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 2 IoCs
-
Modifies system executable filetype association 2 TTPs 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 47 IoCs
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1732233184b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc512.dat-decoded.exe"C:\Users\Admin\AppData\Local\Temp\1732233184b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc512.dat-decoded.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\spooloq.exe"C:\Windows\spooloq.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\spooloq.exeC:\Windows\spooloq.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD562a7ce2fdc8cd0934917aceefac5c13f
SHA1c8e47bc94149a24780baa819dbee13f615034bdb
SHA25669556d896fb5aeb0f58570986df2b49635fa9a7def2663210eb3e0662e629625
SHA51203353ae235380af5fb58c1e75799a6fcb67cf33439a6adf1d03e54b7d92e4d027be4ed1b3ef4b72e48836e3830fc811a4dcc44839990c683fca61bdb7627d93c
-
Filesize
88KB
MD556152bcbac11eaba6549445f86a04d5b
SHA193fcf1db52e936f1ccc28f1d531f13c12923be5c
SHA256b4811bba0d47744362d41bafc1a303d700cc8709c5e216f86dee4148689507cc
SHA5122b2c200d416059d3afe1ee4d72da6d7ea6245200c638ec1f4717758060adc75b7c423165359b400bd5e90eba3378bc41b08af141189a5381d4935cdaada097c4
-
Filesize
64KB
MD5385e7b496b00ea29de872509cb29f5be
SHA15d944b9957d54698cb0319a3e65362435ef5885b
SHA2568169d73b40ee6e81a7ab0bae2f3d761102d03877385d0fd2c26f972e9210ada9
SHA5129fa0973186c1577dea242a0df9b0a23c416da33e7a7f232678669fb0479ca4eec83a0ee21e97c6ce0768e461348740edfdcaefb3324e1572810f493e618c8ba2
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB