Analysis

  • max time kernel
    763s
  • max time network
    537s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/01/2025, 13:33

General

  • Target

    Malware-1-master/Download.exe

  • Size

    247KB

  • MD5

    6a97f4f16e7879967a5c02d143d0bd46

  • SHA1

    0898ccf65770813f69bf339462a05a8c6e17be69

  • SHA256

    de2274da8cf00dfc6e6e52db43f82210a1fb7fd30016ebdc81347fb2d1f248fa

  • SHA512

    0bc14103518a2e234f4e3f4ddc46e91a1ed21c2885fd4eb27d3cf8cd088e4fa4fffcc221ddb404f52794c57d6693b2ce080e797bf33f2322490030e0fce0ac27

  • SSDEEP

    3072:ZV3bDzHY2weWeFoyUWfMRBsfpVZynzK4ChhO2IGmXf3Ur3CvZJnodCKJYsUH+Iun:ZBbDzHY0UsfPwUIvOd1

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Download.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\Download.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4544
  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\UnblockProtect.ppsm" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2116
  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\UnblockProtect.ppsm" /ou ""
    1⤵
      PID:3084

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\C0C3BD6.tmp

      Filesize

      83B

      MD5

      b6b45257616514821e43d1693476ae09

      SHA1

      693b474ee7860db960cec6c4cb5245eb9e9c007a

      SHA256

      abc4fa36d3ed79487a572a4a55bcbe2075df7432ab2abba716e324fdef96de18

      SHA512

      77848d9fc9bdec2ccb03f7ab519fa0948ad0ef63b68df660f2916b4ee240a407cd17f0555f3576d56e6fe977473832cc7709af943d4a900e9244450ea26a90de

    • memory/2116-18-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-16-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-58-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-11-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-14-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-15-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-21-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-19-0x00007FF8622B0000-0x00007FF8622C0000-memory.dmp

      Filesize

      64KB

    • memory/2116-23-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-28-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-30-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-29-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-27-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-26-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-25-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-24-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-22-0x00007FF8622B0000-0x00007FF8622C0000-memory.dmp

      Filesize

      64KB

    • memory/2116-57-0x00007FF8A4683000-0x00007FF8A4684000-memory.dmp

      Filesize

      4KB

    • memory/2116-56-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-17-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-20-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-13-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-12-0x00007FF8A45E0000-0x00007FF8A47E9000-memory.dmp

      Filesize

      2.0MB

    • memory/2116-10-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/2116-8-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/2116-7-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/2116-9-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/2116-6-0x00007FF8A4683000-0x00007FF8A4684000-memory.dmp

      Filesize

      4KB

    • memory/2116-5-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/3084-46-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/3084-49-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/3084-47-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/3084-43-0x00007FF864670000-0x00007FF864680000-memory.dmp

      Filesize

      64KB

    • memory/4544-1-0x0000000074950000-0x0000000074F01000-memory.dmp

      Filesize

      5.7MB

    • memory/4544-2-0x0000000074950000-0x0000000074F01000-memory.dmp

      Filesize

      5.7MB

    • memory/4544-0-0x0000000074951000-0x0000000074952000-memory.dmp

      Filesize

      4KB

    • memory/4544-4-0x0000000074950000-0x0000000074F01000-memory.dmp

      Filesize

      5.7MB