Analysis

  • max time kernel
    1790s
  • max time network
    1563s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-11-2024 02:21

General

  • Target

    343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe

  • Size

    510KB

  • MD5

    565dacda99cc8d28d3e650b4d85e8d24

  • SHA1

    6c5f2ab498ae16332a3863e45d35e47e1aabe001

  • SHA256

    343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303

  • SHA512

    534eeda2e7c99ffef2bf023aa3f68739953ecbdfabcd57ad41af08c8c563fe27f7f8be04e80bdc2904ed0632984968551ddb107917fbe6dfc7a0e704af313946

  • SSDEEP

    12288:M7iBDowvTfS6ublBri5g3D7eJit/mUZ5jI0B57g3l1TV0:/EkStbjfdteUZ+0BQ7TV

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 30 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 11 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • System policy modification 1 TTPs 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe
    "C:\Users\Admin\AppData\Local\Temp\343ace5874a5854858e11e6c196007bffc045717ed29db9b03f23d01568e8303.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE
      2⤵
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Modifies system executable filetype association
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2692
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "ftype asriel=alg "%1""
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2536
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c "assoc .exe=asriel"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1692
  • C:\Windows\system32\alg.exe
    alg.exe explorer.exe
    1⤵
      PID:2716

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\home.htm

      Filesize

      183B

      MD5

      ec974d8dcb26e1462ef53a780acbeeaf

      SHA1

      edcaf178d0e5697967363e9e91a11ac01e9351e0

      SHA256

      30ad9f411bdf68fb4e683326d167c6e098e800438ae87fa48401ef918c45b81a

      SHA512

      159e01452fbb09d92ce3bf0059bf14d9acd956e0ceb7e7b9a0f7311e0432bfc0b232a4102a4ffe6f539200440eb44cf1f421385dcdc3411596d48b0d7e6f5694

    • C:\Windows\System32\oobe\info\backgrounds\backgroundDefault.jpg

      Filesize

      107KB

      MD5

      6a0c11b9977e9aca6083bd5f7ed7d501

      SHA1

      cec8b3eaa2a8ff74a447a69c23afffde6e7bb278

      SHA256

      d4cbab9fbfe4f58322dde41ced37c68288c94334399a50daa559898679dab188

      SHA512

      28a3f1993d2af4e6e7fcace42d34401d983ce46d897e257c314519e7c132897bb1cdc377fef48889efbecb93c3a85ab0629cd400f3905341a4415f428a928c85

    • \Users\Admin\AppData\Local\Temp\IXP000.TMP\SURVEY~2.EXE

      Filesize

      381KB

      MD5

      9fb609d65c73bf9d91ba19dd35b02fd3

      SHA1

      081e3cdf4ff535fde9861b5941d461f1c0b8e8ef

      SHA256

      a559cc64348b108b1d6bc4194cd05c7e23d72aed07fe469f1ca175e4405a873b

      SHA512

      4d3bac285e9529895583c07cc885d0f1d38586e477513f9f66f3a7da2b9c3280706feb1391b491f18fcb3385316a1e86151a80cac3a73a7c16999c405e2ba89b

    • memory/2096-25-0x0000000000020000-0x0000000000023000-memory.dmp

      Filesize

      12KB

    • memory/2096-0-0x0000000000AA0000-0x0000000000B3F000-memory.dmp

      Filesize

      636KB

    • memory/2096-1-0x0000000000020000-0x0000000000023000-memory.dmp

      Filesize

      12KB

    • memory/2096-42-0x0000000000970000-0x0000000000A65000-memory.dmp

      Filesize

      980KB

    • memory/2096-14-0x0000000000970000-0x0000000000A65000-memory.dmp

      Filesize

      980KB

    • memory/2096-27-0x0000000000AA0000-0x0000000000B3F000-memory.dmp

      Filesize

      636KB

    • memory/2692-45-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-57-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-29-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2692-28-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-19-0x00000000001F0000-0x00000000001F1000-memory.dmp

      Filesize

      4KB

    • memory/2692-31-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-33-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-35-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-37-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-39-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-41-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-15-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-43-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-16-0x0000000000150000-0x0000000000153000-memory.dmp

      Filesize

      12KB

    • memory/2692-47-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-49-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-51-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-53-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-55-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-26-0x0000000000150000-0x0000000000153000-memory.dmp

      Filesize

      12KB

    • memory/2692-59-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-61-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-63-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-65-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-67-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-69-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-71-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-73-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-75-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-77-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-79-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-81-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-83-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-85-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-87-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-89-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-91-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB

    • memory/2692-93-0x0000000000400000-0x00000000004F5000-memory.dmp

      Filesize

      980KB