Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 02:55
General
-
Target
a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7.exe
-
Size
64KB
-
MD5
d721e2bf9abc01139dcebd832734eb86
-
SHA1
a1c1f777e8b73dd61b89166798bf05163355c0ef
-
SHA256
a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
-
SHA512
b8d04c658f5a9ad4bd4b3c0940ff24b8f9fc00447293fa3c285d2ac917829aa97864ad6da914e05bce09ecae60a997b69e52978f44dc15fa402e8324e655216a
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIn:8g585LpPCrQt7F84IIIIIIIIIIIIIIIl
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Disables RegEdit via registry modification 2 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 2 IoCs
-
Modifies system executable filetype association 2 TTPs 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 62 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 47 IoCs
-
Modifies registry class 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7.exe"C:\Users\Admin\AppData\Local\Temp\a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SMSSjw.exe"C:\Windows\SMSSjw.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Windows\SMSSjw.exeC:\Windows\SMSSjw.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d721e2bf9abc01139dcebd832734eb86
SHA1a1c1f777e8b73dd61b89166798bf05163355c0ef
SHA256a812ed1d18abc7ac7a202c491ce11a2166a5848118eed23502ed91a102d862c7
SHA512b8d04c658f5a9ad4bd4b3c0940ff24b8f9fc00447293fa3c285d2ac917829aa97864ad6da914e05bce09ecae60a997b69e52978f44dc15fa402e8324e655216a
-
Filesize
88KB
MD57a3013546726a994cfabfcfb15c664ef
SHA1fb556306f92b4626b116950a4733bd4e194ce0e6
SHA2568ab30c2913d3839e4ae1936801c0fdcab6d6bec0696fad9905308d073966a10f
SHA5121fe5a5a389220a6192a6e31d8b188934555300ffdc311304dc4f7d81d7fdc77cb381eecff6987d777a09a71b59279e06bf3e3f17216e62f42f9702578342a628
-
Filesize
88KB
MD596351fb905f54f3515a8158eb779603e
SHA198ea130002f203e6b0bee2696eed0fd562c72015
SHA2564094c0f1ac2bd0884c08a3e3c123967c6dbb3745437ac8b0e7d6c863a59dd2b8
SHA51264489eb4db9ec86855c4615b1c6ace4c9ad802b69a8af30752b2d053f49ec2d65fa704464a10c7ae8e008511a213dd2ca15dce22e28e2c4f9632ab49ca626aac
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB