Analysis
- max time kernel
144s - max time network
220s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
- submitted
29/12/2024, 10:46
General
- Target virussign.com_001d76c0f2266cf5275017fe1f500bf0.exe
- Size 226KB
- Sample241229-mt58aazkh1
- SHA256 c3dc11574446e9f6f6a68bc92e709b5377c712401907e149c0507192db955be5
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\virussign.com_001d76c0f2266cf5275017fe1f500bf0.exe"C:\Users\Admin\AppData\Local\Temp\virussign.com_001d76c0f2266cf5275017fe1f500bf0.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dfs5061.tmp
memory/2920-11-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-18-0x000000000A830000-0x000000000AFD6000-memory.dmp
memory/2920-1-0x00000000000F0000-0x00000000000F3000-memory.dmp
memory/2920-7-0x0000000000300000-0x000000000035C000-memory.dmp
memory/2920-8-0x00000000001E0000-0x00000000001EA000-memory.dmp
memory/2920-9-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-3-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/2920-10-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-12-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-0-0x0000000000360000-0x00000000003EB000-memory.dmp
memory/2920-19-0x0000000073DCE000-0x0000000073DCF000-memory.dmp
memory/2920-24-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-25-0x0000000000360000-0x00000000003EB000-memory.dmp
memory/2920-26-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-27-0x0000000073DC0000-0x00000000744AE000-memory.dmp
memory/2920-28-0x0000000073DC0000-0x00000000744AE000-memory.dmp