aa2bc6bdab3c1cd9cc94e92a00f2501ffd6bef384e69e605b9533ee4a9af2fcc

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/12/2024, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Court Project V1.1/Court Project.exe
Size

75.3MB
MD5

237a78a3b4b36d749f0e46d26dbc965b
SHA1

f73af65ad456feb2bf5159161ff4b9ace5202598
SHA256

26cf8403cb6124796a98eb4644b3d75569bea2ba156456d0dd1b0b04ad3b3572
SHA512

7223a6692a131c47c7aade3a0ddd7a1fb3dbb420e824921b508565d7363185229d419e3df9e4dd3abf96200945ad076c592712fecf68f47b7e7d9105c59eac89
SSDEEP

1572864:ivFUQpjkuwSk8IpG7V+VPhqS0E7WZRjRH2PRQvS6f97PyhonB08yfXWulZvFVN:ivFUqA7SkB05awSgZRdW2S6f9jnB08Qd

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2088	PHONE LINK.EXE
3060	PHONE LINK.EXE
1152	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
2080	Court Project.exe
2088	PHONE LINK.EXE
3060	PHONE LINK.EXE
1152	Process not Found

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x000400000001d704-1278.dat	upx
behavioral3/memory/3060-1280-0x000007FEF60F0000-0x000007FEF655E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Court Project.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2512	2080	Court Project.exe	31
PID 2080 wrote to memory of 2512	2080	Court Project.exe	31
PID 2080 wrote to memory of 2512	2080	Court Project.exe	31
PID 2080 wrote to memory of 2512	2080	Court Project.exe	31
PID 2512 wrote to memory of 2896	2512	cmd.exe	33
PID 2512 wrote to memory of 2896	2512	cmd.exe	33
PID 2512 wrote to memory of 2896	2512	cmd.exe	33
PID 2512 wrote to memory of 2896	2512	cmd.exe	33
PID 2080 wrote to memory of 2088	2080	Court Project.exe	34
PID 2080 wrote to memory of 2088	2080	Court Project.exe	34
PID 2080 wrote to memory of 2088	2080	Court Project.exe	34
PID 2080 wrote to memory of 2088	2080	Court Project.exe	34
PID 2088 wrote to memory of 3060	2088	PHONE LINK.EXE	35
PID 2088 wrote to memory of 3060	2088	PHONE LINK.EXE	35
PID 2088 wrote to memory of 3060	2088	PHONE LINK.EXE	35

C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\Court Project.exe
"C:\Users\Admin\AppData\Local\Temp\Court Project V1.1\Court Project.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\COURT PROJECT.BAT" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
- C:\Users\Admin\AppData\Local\Temp\PHONE LINK.EXE
  "C:\Users\Admin\AppData\Local\Temp\PHONE LINK.EXE"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\PHONE LINK.EXE
    "C:\Users\Admin\AppData\Local\Temp\PHONE LINK.EXE"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\COURT PROJECT.BAT

Filesize
2KB

MD5
4b79c671ac1da07985c8d8b4f18005f7

SHA1
ef81a3c16e46c18eecab45fa57a0dc3f42370bcc

SHA256
203a80db0214a96de01c1bed84170b507565397ecc5fae047b7d2a005a7e9511

SHA512
681238af8f8bf83ec8ad0a57f50af08f93bca7b01d0a3b7c7d4592375ff8bbae3ac1b617eb7ab2f4b7ae4fb3470ab0c3dee6840275747a1f1c42907e49f30710

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI20882\python310.dll

Filesize
1.4MB

MD5
178a0f45fde7db40c238f1340a0c0ec0

SHA1
dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe

SHA256
9fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed

SHA512
4b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee

Download Submit
memory/3060-1280-0x000007FEF60F0000-0x000007FEF655E000-memory.dmp

Filesize
4.4MB

Download