Analysis

  • max time kernel
    111s
  • max time network
    78s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    08/01/2025, 05:20

General

  • Target

    59a9c7259269c682396907b47d6becd585009782cbd0f0a6c01e16a19ce8df92.exe

  • Size

    667KB

  • MD5

    4f526c831dac0eeaa300e9c7e9e68a02

  • SHA1

    3187db467bbd09e87b8f9feb796a09c3e89afd57

  • SHA256

    59a9c7259269c682396907b47d6becd585009782cbd0f0a6c01e16a19ce8df92

  • SHA512

    1bced85f6687f03c8a5bb2cf3d4eb288de01aeb561eb3f5978560f8d9888ad8d269d6c56e891d5ec5d4d8d8ce4d839f6669030bfd3cc83b800edc9fb27275043

  • SSDEEP

    12288:W/vpWeFENjQBlzV7IksYhLRwXI3Kc9ZdkfnPEvo4F75JSGCdi:W/v4DNjcZ6GXKIdkfPXQJMM

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • UPX packed file 41 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\59a9c7259269c682396907b47d6becd585009782cbd0f0a6c01e16a19ce8df92.exe
    "C:\Users\Admin\AppData\Local\Temp\59a9c7259269c682396907b47d6becd585009782cbd0f0a6c01e16a19ce8df92.exe"
    1⤵
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1740

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\ISH259~1\images\grey_btn_hover.png

          Filesize

          1KB

          MD5

          7a276b1b63e144b39a6f3eeb7f514672

          SHA1

          16d906483255b086eccfd74f77636d45be640351

          SHA256

          c1ada63a257cc434b96624ff37283c87fe27f7da31df1ba78bd31dbf55032cdb

          SHA512

          1118928de55e2e6cd5a3e9e11181abcd7cb281a2229dcefbc79aa3158a1dced587886fb32e55b87b32351b068dd9e1bc9a70a22226007b8e79844c209c8689f1

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\bootstrap_16777.html

          Filesize

          156B

          MD5

          1ea9e5b417811379e874ad4870d5c51a

          SHA1

          a4bd01f828454f3619a815dbe5423b181ec4051c

          SHA256

          f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a

          SHA512

          965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\css\main.css

          Filesize

          5KB

          MD5

          2bde1d7efe6a6573c8de1b74899c2339

          SHA1

          13e4e5425818bfe2d393a543529a4f296f2d5702

          SHA256

          24f07d26a87cfb6d66c4844145b1a00dc8b8bcf2368f2503441a0cf6312edcd1

          SHA512

          daaac3d2a15b95516fdc209e41f3b75c781f2860cd4005c82ada54e9fbdaf1944e2032d45a87a2e799a7e208840f3c47aa306d63c47dfaab1082b0b63d3e617e

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\css\sdk-ui\progress-bar.css

          Filesize

          506B

          MD5

          5335f1c12201b5f7cf5f8b4f5692e3d1

          SHA1

          13807a10369f7ff9ab3f9aba18135bccb98bec2d

          SHA256

          974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda

          SHA512

          0d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\bg.png

          Filesize

          4KB

          MD5

          b24d84cf4249db2ada3d342c70d5163d

          SHA1

          208034eafee6f328f169be2ce68e50c831bdc35f

          SHA256

          044afcd020218a480abc496c7674c9d832887586e0a4bb97102745c8265a8358

          SHA512

          70ad29c6f22300a46ab3b59711616a59eae95f9e5bde45c450319d6e84b71f1b8c89d60001a27a8f6be4557dc89d20bcd8b5c61bbe53e335dceea5b0a0b903e1

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\close.png

          Filesize

          674B

          MD5

          ad176366ebe059e8abd488783a76bbf5

          SHA1

          1284ba936a3324fd831abdf6be2ada966d5d1ff7

          SHA256

          59830ddcb786e0919c64992ff23a691ac2461027bfd76d3d5fdb0c00c5ed9aaf

          SHA512

          455bfe612b882fc85f75b5ccd933fe67d12c529cd9f4bccb3195e793aa713502567ec5059c1adfb95cfc3c51445d40fb11e4c968102f9014e701dd9e173e2fb8

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\close_hover.png

          Filesize

          1004B

          MD5

          25407354a0e3e5a141aa10a00801de76

          SHA1

          80c8d5848c442d4a5f829955cae79999ace65b3a

          SHA256

          b9c3126c4883a9c9b3e84a3745e87ff39d299476dbd0077b9f628cb4a31b3076

          SHA512

          7bbc40b9553d0924d89b0ff9a603c0371df7d7fff14ad782a58af16840246a765425ba49e9c7ab8dde61d2b896a5238ea8137f1d35108fa6ad5983f5c147759b

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\color_btn.png

          Filesize

          254B

          MD5

          0d75708d98e011f6027ac903c7c36a3d

          SHA1

          01efee78ccb8dfb34aea9503a39d2db15192bcd7

          SHA256

          ac178bfeaba3450abd96cc51718c6ac8a44fb061edb759a5a029f35d766b609f

          SHA512

          be96106172398b5c0c4f52450b56b390e0003b5bc233f8f1cec7eeab8078b78f06e28a8e2dd7dfe8c30a160b84d77e7abc3f89b87eb8176357e352338e2acaf4

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\grey_btn.png

          Filesize

          253B

          MD5

          43fae9b8361c534953dcbc5deb6e71ea

          SHA1

          c16f6d4141b699f12c3ed8f68036c8469eeb2a5d

          SHA256

          4c2210f9defd73ed3bd817d55fb9e303d7bf470e90f3dd5bb9132697138a5984

          SHA512

          d7cd648417e8736a98a3cb0ccd9083e00e914164aaf476f78712701495b5418e27a3bb1e9fff01abd3984a8eb754b567cde37fe228b8c5e3db10741e9910e0f9

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\loader.gif

          Filesize

          10KB

          MD5

          57ca1a2085d82f0574e3ef740b9a5ead

          SHA1

          2974f4bf37231205a256f2648189a461e74869c0

          SHA256

          476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e

          SHA512

          2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\min.png

          Filesize

          226B

          MD5

          6e001b86bca7b00cdfcc0a6d180bac8f

          SHA1

          af69e7d0462aa3c5370ae30f67c1476931e89afc

          SHA256

          1c36900402b79d75890e7aa44ef2788af16919d178db49928b4cc949b2b0661d

          SHA512

          e5bb0e49e47cfce57b5f0e94bfb2e75af8b32c6bb0187105ddcb04847a22983917cc6058fe5da8f9f82ee9537d1dae32a82679f3d8ca863efa8c67e2fe216d6b

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\pause_btn.png

          Filesize

          493B

          MD5

          818b8908ace0ccc5fecbca20f2919587

          SHA1

          e599b4229d622c36bc6cd5b155c94c50d1a68b86

          SHA256

          ad2ec992fc336af09f7be4a652d240936a08bf522d10ff7fbec5dbfe0c4d332d

          SHA512

          7d63287a12f519524146f7ed620aee6724489fa351752e7eb64e99fae098e524e744e570d2b7abc21f89064cff2bdaa9864f7f0cda9fb9ca861d1df9a45bcd9f

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\progress.png

          Filesize

          104B

          MD5

          35a600a752d3074501de31a516860499

          SHA1

          51eac62cf77a0b88a3e9cb9ee6f85def21fd4bcf

          SHA256

          14e064857751b23da7bbe40861ef4caf99b2496227507b8e3108fbac6d901f75

          SHA512

          046ec179571d239bfb2d51be9837f96d9afebf2e5db77bba0f4a25ce8716d37581a3f9753bd2dbb04c47711699a9d93987bceb71df0b8becf8c577d660320069

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\progress_bar.png

          Filesize

          812B

          MD5

          eabb61abba55f80af418fa1128d1548d

          SHA1

          a5ee1d55de2cc60966039120c830fc19cefb0351

          SHA256

          717f3f02f5d5fd1478b6d2ec44acef6e70bb8f1adcf2dc030c08b92e851737e1

          SHA512

          d232072c9540bf0e2fd56f353c2cc83518eabf8282cc02d9f8bec81c0341287ada29ba79f2a515d68722658686b6cce97be138a48f44409562d9a567af200bd6

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\images\resume_btn.png

          Filesize

          681B

          MD5

          5f8dcbf4ebc42ad95cfc4d9401283972

          SHA1

          e4060ea37daa2953bfdf8a773e447143f6365e75

          SHA256

          931193720d26f0007ad223fca1a440f4866047a0ca96f5d29de3e62e7ba6a731

          SHA512

          f918c4b834dff01c82f4b0063708d9155aef87b40fa3ae101d5d0a761ed17a348ff6ba4fb5f1e6ba4921698dcbb3e8291a25e48d180092107cb05660d948a61d

        • C:\Users\Admin\AppData\Local\Temp\ish259426839\locale\PT.locale

          Filesize

          2KB

          MD5

          702a944b858b3ba077977e2dc4e5c999

          SHA1

          0f81cb962e0868815407aa5bff738e0e644e8987

          SHA256

          bbb5e870f69bb7f6c315f3d3fc25481db7153abebdefc176f68d333a2e000664

          SHA512

          0f46f489a5a67b53c7c6be2f2fa212d6f167ff192abc79801066d59a11ee7e2fe3df9697c8f87777729c95bee703108e465e091bf49632b89491685ae9976c68

        • memory/1740-173-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-182-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-133-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-134-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-108-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-107-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-7-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-6-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-1-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/1740-157-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-5-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-2-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-114-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-0-0x0000000000401000-0x000000000040B000-memory.dmp

          Filesize

          40KB

        • memory/1740-113-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-116-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-175-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-178-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-115-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-177-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-109-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-179-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-174-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-181-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-194-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-195-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-196-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-197-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-198-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-199-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-201-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-203-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-206-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-208-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-209-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-210-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-211-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-212-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-213-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-215-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-214-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-218-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB

        • memory/1740-220-0x0000000001BF0000-0x0000000001D46000-memory.dmp

          Filesize

          1.3MB