Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-11-2024 18:55
General
-
Target
MEGAsync.exe
-
Size
73.4MB
-
MD5
6336015b6d228b6c96acf2399529b1b0
-
SHA1
99a7633366b448e47dd5efaa78a24db611d541c4
-
SHA256
06223d2aa372208b8fab2c5d70651f29b90d6bc18e83b9e3225e97367dc0acc2
-
SHA512
ab46bb40bb0088da45fe22df72cff8c3f7c0a03ae561a22a700aedc6aa1e4657bb8bfc92acf267461185f77e4e19096e91554ed274ebe282ecd0013805bf239b
-
SSDEEP
786432:4U9PW1PztyRdnVtztBpTaf1lW03V+cAPzP9gmX3dYc2uzPBWO:4YNFVt1TafX3VMKcdYcVWO
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\MEGAsync.exe"C:\Users\Admin\AppData\Local\Temp\MEGAsync.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52337898832a3808012209e32d3309ae0
SHA131155d74a2ed2182b01bfa0bfeac36023032dccc
SHA25611c67be785e7d0da8a06466a357669f6026ffbb925ab23b938dbbcd002cd22fb
SHA512574fd99c54afd8929b6a84264746a60b30db98591a2963b39ea8213a6126eb1db33b0e815b78f46aa61ad11187f77cd6ebf2b89267c6e1909837b9c73f86bc43
-
Filesize
40KB
-
Filesize
76.9MB
-
Filesize
40KB
-
Filesize
2.0MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
4.3MB
-
Filesize
64KB
-
Filesize
5.3MB
-
Filesize
40KB
-
Filesize
4.0MB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
8KB