Analysis
-
max time kernel
96s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 07:44
General
-
Target
0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.exe
-
Size
3.4MB
-
MD5
033ac886c37222c04c61681c0cc6f912
-
SHA1
d740c7103969ceb5432d762a1f2b78c2b84bd274
-
SHA256
0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55
-
SHA512
e4d013fac25752b1fde69c75e849b1bda335d2e5283139b0b94964a45b11f8dc23bb802b122d298ec7f155641ab3983ab12bef6174695886146c0cae19a8db53
-
SSDEEP
98304:tiTy7/saBN7MmShOuiA6hl7hfawmq7xiTVP:tBbDQmSkuv6rAwxli5P
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 19 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.exe"C:\Users\Admin\AppData\Local\Temp\0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-T64OJ.tmp\0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.tmp"C:\Users\Admin\AppData\Local\Temp\is-T64OJ.tmp\0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.tmp" /SL5="$9016C,2762062,770048,C:\Users\Admin\AppData\Local\Temp\0fa63b2fbc454c348286b54b9532861ec0e079f257567b642e31625866648a55.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\TSPYL5\ZNF783\DAB2IP Gene Methylation, Alpha-Fetoprotein and Des-γ-Carboxy-Prothrombin Combined Detection analysis software\LiverClear Analysis Software.exe"C:\Program Files (x86)\TSPYL5\ZNF783\DAB2IP Gene Methylation, Alpha-Fetoprotein and Des-γ-Carboxy-Prothrombin Combined Detection analysis software\LiverClear Analysis Software.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD572a6818fff95da6a50ae9fb8ad21aa1b
SHA1a8536cb212913e152220ebdb041d65fce6060c96
SHA2564f48bc6ae6f94e48830583f5289662f5f93c2a03b2847857f75818b18798a955
SHA51225646facf30e96e7218e5e3e4a0913cb413bcc4c847e7cd808dde5721a0a99f9ab085072f30905fa2ed5b6308e9f05d502874360ebc1e54e8dc4b5fa6f66fedf
-
Filesize
124KB
MD51245f66a4232ad5de321493c7fd48dc4
SHA186d8f4186570887982fe21fc03779951942f0339
SHA256ccdadf439752a0501a86c68a616634086394d889eca7c782e11790e42120d068
SHA51206ee6a2d6a8b63de15a1aeab801b59555ae514a5248c72b2c3f9263aabf27315e551ad037af9581d5aaf53381bd26ee07379b2f658842ebf37420f23a88976c3
-
Filesize
12KB
MD500def0faedda529f16685e15100dbcbc
SHA15f50bb8c38732e7b83c0270efc1a91ef7263760a
SHA256235c9fd8a258290c077c8984b337038e12212ed018fcfa13da0c02be7d9556c7
SHA5128c9045637da969dfb48e5e37316a1ea7644898fe82c468187aca0c0944eb3a388296354be8ab44ab88d3b6bfa341b9b73a8afd2d4ed8f77ac4233d60d7a6e265
-
Filesize
3.0MB
MD5fab4f4120bb93526894855daa2bd403f
SHA12ba342bcf9ce87902de51a568c5c686b5afb93a5
SHA256b4b6f8d35756dac631070e7896d486654f80d09745e310b4d9b060465dc77658
SHA51281a5ea001b3532db535554537e8680cdd4fa24557657dcddb61155acd308b3ab3a32b045ef7999c639bb9a104fec733435aa143ed6e0519128e9e0f89d469060
-
Filesize
804KB
-
Filesize
668KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
6.2MB