Overview

overview

10

Static

static

10

InstalIŠµr...18.exe

windows10-2004-x64

10

TT18.exe

windows10-2004-x64

10

TTDesktop18.exe

windows10-2004-x64

10

TikTokDesktop18.exe

windows10-2004-x64

10

adjthjawdth.exe

windows10-2004-x64

10

bxftjhksaef.exe

windows10-2004-x64

10

cli.exe

windows10-2004-x64

3

dujkgsf.exe

windows10-2004-x64

5

fdaerghawd.exe

windows10-2004-x64

7

fkydjyhjadg.exe

windows10-2004-x64

10

fsyjawdr.exe

windows10-2004-x64

10

gjawedrtg.exe

windows10-2004-x64

10

hfaewdth.exe

windows10-2004-x64

10

jgesfyhjsefa.exe

windows10-2004-x64

10

jhnykawfkth.exe

windows10-2004-x64

10

kfhtksfesek.exe

windows10-2004-x64

10

kohjaekdfth.exe

windows10-2004-x64

7

krgawdtyjawd.exe

windows10-2004-x64

10

kthkksefd.exe

windows10-2004-x64

10

kyhjasehs.exe

windows10-2004-x64

10

kyjjrfgjjsedf.exe

windows10-2004-x64

7

lfcdgbuksf.exe

windows10-2004-x64

10

lkyhjksefa.exe

windows10-2004-x64

10

lyjdfjthawd.exe

windows10-2004-x64

10

nbothjkd.exe

windows10-2004-x64

10

nhbjsekfkjtyhja.exe

windows10-2004-x64

10

nothjgdwa.exe

windows10-2004-x64

7

nthnaedltg.exe

windows10-2004-x64

10

pghsefyjhsef.exe

windows10-2004-x64

10

pyjnkasedf.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2024 21:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dujkgsf.exe

  • Size

    135KB

  • MD5

    bc48cb98d8f2dacca97a2eb72f4275cb

  • SHA1

    cd3dd263fc37c8c7beb1393a654b400f2f531f1c

  • SHA256

    c18fb46afa17ad8578d1edd4aa6a89b42f381ca7998a4e5a096643e0f2721c49

  • SHA512

    7db6992278ca008e7aafa07eb198b046a125d23ca524f15d5302b137385dd4e40a4a54ce4dabb28710b71fbcfdd2d3315fb36e591edc2b3e1737b11b9ee45a5c

  • SSDEEP

    3072:1TGtOioVUSuLwYMdbQro39gSms+rkNgrQ8WZW:peoVU9JMdbQrbvtG

Score
5/10
discovery

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer Phishing Filter 1 TTPs 24 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe
    "C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe
      "C:\Users\Admin\AppData\Local\Temp\dujkgsf.exe" /normal.priviledge
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1156
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:3712
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        PID:2948
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:440
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2200
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1240
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:4112
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2396
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:3728
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1592
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:432
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:3604
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2300
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1920
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1912
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:376
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:1628
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2444
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:3192
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2088
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:4244
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:4556
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:3944
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" shell32.dll,Control_RunDLL inetcpl.cpl,,6
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer Phishing Filter
        • Modifies Internet Explorer settings
        PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads