98d520115f3c179f332f9848af44aeeffd115c152e8105e7be247648021430b5

Resubmissions

24/01/2025, 21:43

250124-1kyzha1nhr 10

24/01/2025, 21:41

250124-1j76sazna1 10

24/01/2025, 21:40

250124-1jejga1naq 10

Analysis

max time kernel
37s
max time network
16s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
24/01/2025, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wetransfer_hotmail-txt_2025-01-24_2133.zip
Size

52.0MB
MD5

17854d89a4f57f4b5a3eacee2612064b
SHA1

47120215f62694b95684c2e45b747836871dc7c9
SHA256

98d520115f3c179f332f9848af44aeeffd115c152e8105e7be247648021430b5
SHA512

c333b8d1790775a487fc4d13daa4456400f67102c59719ba3f8f90551b148dcaa258a13687914fc445ba138ba4556e0fcf302e804d55455fb2dc6e1bbbc8065c
SSDEEP

786432:yWo2ZhNiqGL+qHFcDJExAFsHEAayG4jzGgjqoLkW9FAa3MbJUSxDMQpPdXYE9P:yWd2qmJHFcN6AFEEtyH9qoB7Asy3npPV

Score

7^/10

upx

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2108	vosfn.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00050000000194a9-40.dat	upx
behavioral1/memory/2108-42-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp	upx

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
684	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	684	7zFM.exe
Token: 35	684	7zFM.exe
Token: SeSecurityPrivilege	684	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
684	7zFM.exe
684	7zFM.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2108	2312	vosfn.exe	35
PID 2312 wrote to memory of 2108	2312	vosfn.exe	35
PID 2312 wrote to memory of 2108	2312	vosfn.exe	35

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\wetransfer_hotmail-txt_2025-01-24_2133.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:684

C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe
"C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe
  "C:\Users\Admin\Desktop\Fortnite\Fortnite\vosfn.exe"
  2⤵
  - Loads dropped DLL
  PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI23122\python311.dll

Filesize
1.6MB

MD5
ccdbd8027f165575a66245f8e9d140de

SHA1
d91786422ce1f1ad35c528d1c4cd28b753a81550

SHA256
503cd34daed4f6d320731b368bbd940dbac1ff7003321a47d81d81d199cca971

SHA512
870b54e4468db682b669887aeef1ffe496f3f69b219bda2405ac502d2dcd67b6542db6190ea6774abf1db5a7db429ce8f6d2fc5e88363569f15cf4df78da2311

Download Submit
memory/2108-42-0x000007FEF5F60000-0x000007FEF6552000-memory.dmp

Filesize
5.9MB

Download