Overview
overview
10Static
static
7Untrimmed.exe
windows7-x64
10Untrimmed.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Devastatin...er.dll
windows7-x64
1Devastatin...er.dll
windows10-2004-x64
1Laursens/S...re.dll
windows7-x64
1Laursens/S...re.dll
windows10-2004-x64
1Laursens/S...er.dll
windows7-x64
1Laursens/S...er.dll
windows10-2004-x64
1Prostatism...46.dll
windows7-x64
1Prostatism...46.dll
windows10-2004-x64
1Prostatism...-6.dll
windows7-x64
1Prostatism...-6.dll
windows10-2004-x64
1Puntlatsh/...ff.dll
windows7-x64
3Puntlatsh/...ff.dll
windows10-2004-x64
3Symbranchi...10.dll
windows7-x64
1Symbranchi...10.dll
windows10-2004-x64
1Udspecific...rd.dll
windows7-x64
3Udspecific...rd.dll
windows10-2004-x64
3Udspecific...LV.chm
windows7-x64
1Udspecific...LV.chm
windows10-2004-x64
1Udspecific...on.pdf
windows7-x64
3Udspecific...on.pdf
windows10-2004-x64
3Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
27/12/2024, 01:56
Behavioral task
behavioral1
Sample
Untrimmed.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Untrimmed.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Devastatingly143/Begyndelsesordene/vmrawdskver.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Devastatingly143/Begyndelsesordene/vmrawdskver.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Laursens/Synstetiskes/Laquais/Ttsiddende/ServiceCore.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
Laursens/Synstetiskes/Laquais/Ttsiddende/ServiceCore.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Laursens/Synstetiskes/Laquais/Ttsiddende/System.Xml.ReaderWriter.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
Laursens/Synstetiskes/Laquais/Ttsiddende/System.Xml.ReaderWriter.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Prostatism/Mellemfristet/Aprioriskes/lang-5146.dll
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
Prostatism/Mellemfristet/Aprioriskes/lang-5146.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Prostatism/Mellemfristet/Aprioriskes/libfreetype-6.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
Prostatism/Mellemfristet/Aprioriskes/libfreetype-6.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Puntlatsh/Chromophobic30/APM_Aiff.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
Puntlatsh/Chromophobic30/APM_Aiff.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Symbranchia/libgmp-10.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
Symbranchia/libgmp-10.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Udspecificerendes/Kommunekemis/demasculinisation/Blizzard.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
Udspecificerendes/Kommunekemis/demasculinisation/Blizzard.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Udspecificerendes/Kommunekemis/demasculinisation/Bluetooth Suite help_LV.chm
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Udspecificerendes/Kommunekemis/demasculinisation/Bluetooth Suite help_LV.chm
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
Udspecificerendes/Kommunekemis/demasculinisation/How-To CFF Extension.pdf
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
Udspecificerendes/Kommunekemis/demasculinisation/How-To CFF Extension.pdf
Resource
win10v2004-20241007-en
General
- Target Untrimmed.exe
- Size 1.5MB
- Sample241227-cc4m1syner
- SHA256 723d80c135349493233609d246043e692e87cf1a9976a06a58837fcf4d4eba04
- MD5 32f2cb3180077e9886042bd21a2892fc
- SHA1 c237fbdf4adde0417aa34f1938436a027b72f2f6
- SHA512 673c4c86d519d021c6cf027d64af4df5977355e4d74041a1d80ff1862b6fa7b378f012af1a926bb7cc166811eee1879cbb678096d6108ac43ace2ebb2da14455
- SSDEEP 49152:IGIyoUTjnn7HO8mcLr4ZluTjou7sWgB33X:I7yogOcsZefqBnX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2100 Untrimmed.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Valencies.lnk Untrimmed.exe File opened for modification C:\Windows\SysWOW64\projektherrerne.Ind Untrimmed.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Religion\Overcultivation\Trianglen.ini Untrimmed.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Untrimmed.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsv720.tmp\System.dll
- Size 11KB
- SHA256 5a1c20a3e2e2eb182976977669f2c5d9f3104477e98f74d69d2434e79b92fdc3
- MD5 7399323923e3946fe9140132ac388132
- SHA1 728257d06c452449b1241769b459f091aabcffc5
- SHA512 d6f28ba761351f374ae007c780be27758aea7b9f998e2a88a542eede459d18700adffe71abcb52b8a8c00695efb7ccc280175b5eeb57ca9a645542edfabb64f1
- SSDEEP 192:eF2HS5ih/7i00dWz9T7PH6lOFcQMI5+Vw+bPFomi7dJWsP:rSUmlw9T7DmnI5+N273FP
- MD5 SHA1 SHA512 SSDEEP