782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-01-2025 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
Size

1.0MB
MD5

33961801df7df4040fb2282d6103286c
SHA1

1c0b29fa3a333974788a71c896e30f38e2bf3769
SHA256

782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a
SHA512

0d7a73ff1312de597fc71d3d5d0dda34e326ad2268a762695487547361a734568f21f1d0856dd9a502b704a9d5caa7ebc547baa329dc0f906ec003ca23dbd44a
SSDEEP

24576:CMjhKbkkc7tiPbWJF9WUqMFWsRvtciqgQRgOD39wKX:RI4kOtiTQWU4SciuRgC9T

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp

Loads dropped DLL 8 IoCs

pid	Process
2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
2656	regsvr32.exe
2008	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
572	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2348 wrote to memory of 2260	2348	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	31
PID 2260 wrote to memory of 2340	2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	32
PID 2260 wrote to memory of 2340	2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	32
PID 2260 wrote to memory of 2340	2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	32
PID 2260 wrote to memory of 2340	2260	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	32
PID 2340 wrote to memory of 572	2340	cmd.exe	34
PID 2340 wrote to memory of 572	2340	cmd.exe	34
PID 2340 wrote to memory of 572	2340	cmd.exe	34
PID 2340 wrote to memory of 572	2340	cmd.exe	34
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 2340 wrote to memory of 828	2340	cmd.exe	35
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 828 wrote to memory of 2692	828	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe	36
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2692 wrote to memory of 2656	2692	782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp	37
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38
PID 2656 wrote to memory of 2008	2656	regsvr32.exe	38

C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
"C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\is-MEPFA.tmp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MEPFA.tmp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp" /SL5="$4010A,702433,203776,C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C timeout /T 3 & "C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe" /VERYSILENT /SUPPRESSMSGBOXES
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /T 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:572
  - - C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe
      "C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe" /VERYSILENT /SUPPRESSMSGBOXES
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\is-FTB41.tmp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-FTB41.tmp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp" /SL5="$301D8,702433,203776,C:\Users\Admin\AppData\Local\Temp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.exe" /VERYSILENT /SUPPRESSMSGBOXES
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2692
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "regsvr32.exe" /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2656
        
        C:\Windows\system32\regsvr32.exe
        
        /s /i:INSTALL "C:\Users\Admin\AppData\Roaming\\UptightChicken.dat"
        7⤵
        Loads dropped DLL
        
        PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\UptightChicken.dat

Filesize
1.4MB

MD5
f7af43ee4b917ecc5051c5cb3a0ffe5c

SHA1
786c74765b5121ab1fa431fc02d8dfd54eae9458

SHA256
a43e88349c0757c3f122657e6696becde5316f9c31764eaee04e722a87f4b15b

SHA512
6d7872e536e1c4aad3dc06f3d244c2f40bfe2dda417c7555b2387b98fe9bab88654db05ba9dfeadd29959cf9c44a16205e6a95d3465fbda77e6c95344a09b5b7

Download Submit
\Users\Admin\AppData\Local\Temp\is-IJVFH.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-MEPFA.tmp\782d0356109cd4bdbf0c69932dd6f753754a426927c26f7db60bff7344c46c1a.tmp

Filesize
1.2MB

MD5
75c6fbc94f75010aebb8c0c11a646fcc

SHA1
00de6a9f9b02ac9e24db302fc705420740ca9029

SHA256
ba9099f858da9b41bae8a46ca4b8a61b099a18cdbf43bcd3a2c31c0b8e30bede

SHA512
e7f8d81d430258a3ddb07e2798cceb2a8cdd2e3150cdce8e88b745dfdf14f3491076212256a7d3c1b43217c47dd182c9822b4e9da34dbcf7760cbf05d525602b

Download Submit
memory/828-15-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/828-37-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2260-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2260-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2348-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2348-2-0x0000000000401000-0x0000000000417000-memory.dmp

Filesize
88KB

Download
memory/2348-42-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2692-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download