Analysis
-
max time kernel
93s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
11-10-2022 11:33
General
-
Target
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe
-
Size
584KB
-
MD5
11a2f493604e36030ce9d0ccb4487ae0
-
SHA1
e39e9e619185b8873cb9179231cb59b25be0f9f3
-
SHA256
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916
-
SHA512
1188f7802dba3f1712938840e0f85424812cb890f9e0b8d089e839ccb33068d81f99d36228b75e7bdcbe0cd1034ccf68b0295711ac7d799eba17ffc30efc1894
-
SSDEEP
12288:frxC+a9jEXiDcu4nalJRdgHZoEXRs/4v+o:frE9jEy76KP6vhs/I+
Malware Config
Signatures
-
ASPack v2.12-2.42 26 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 12 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 9 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe"C:\Users\Admin\AppData\Local\Temp\e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\09c00787.exeC:\09c00787.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S58XVZL8\QQBrowserSetup[1].exeC:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S58XVZL8\QQBrowserSetup[1].exe2⤵
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Irmon1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nla1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Ntmssvc1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s NWCWorkstation1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s Nwsapagent1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s SRService1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s WmdmPmSp1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s LogonHours1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s PCAudit1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s helpsvc1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s uploadmgr1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
MD5d5dbb416cc6ab7b22b8af372459e0d27
SHA1228fbbee6c621794f98442bf2bc1a557f982a333
SHA2567a19f3e148632551c6a26ef79d349fb6474d80ec9337e001da56ffd0d7ea7d37
SHA51232c89df85d1e7df6b62643d89225542eee6a2cf3a13fc4dea779adb66baf188396bac829fc821498081166b530fdbc79fbb903d612baefcbc5496222b4d192d7
-
Filesize
240KB
MD5d5dbb416cc6ab7b22b8af372459e0d27
SHA1228fbbee6c621794f98442bf2bc1a557f982a333
SHA2567a19f3e148632551c6a26ef79d349fb6474d80ec9337e001da56ffd0d7ea7d37
SHA51232c89df85d1e7df6b62643d89225542eee6a2cf3a13fc4dea779adb66baf188396bac829fc821498081166b530fdbc79fbb903d612baefcbc5496222b4d192d7
-
Filesize
10.4MB
MD5ad98fc3eda02fc26f09fc9e0ebbac1a8
SHA1a95cde4beb8a953a3d07d20a156212ab1d11d259
SHA25623044a25d4dbc20333bfd6fc8e64c642b70e677592ff287299108a41a485236d
SHA512b0a5666d9645bda72e1d0a2c2a533446b203a55d8cad2c08cc24c8ea2b4230862b99915951d27fc06ed366a0b34a5a311ddbb5931146f0379f80e7e04208531d
-
Filesize
11.6MB
MD5ab14548a8fe90d03c14aea6ecf22ac0d
SHA144697b7f24276d02154c01414ed216269988ecff
SHA256c2771b5328c77adb57f2c6bc53a91dc1b33f3101030d0a4ac5c1464e5f0e8ed2
SHA51215ac79a7248bf6d2dc4dd954f3f8f4868e33d463a49327653a0a49b1cf1c7dbd472f5116ba7ecb8f6bb6d0c29614471911f8b659c5b17330e813878333c4106f
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
240KB
MD522283ef82fb788e2f2a72e9c43c589e4
SHA188881a32b8c22e7a14f54822d5241c1ddfeb4a94
SHA25649e31d4cae02ede20b93a89126e53280121aeba635a498be76050b96478eeb0d
SHA5126134aaa9456b18592419e53dd061f1e0f88f702a76b445125c55c51e346c2c2bf6bfa60ffecee0f39e39253b382c172e0d736a5d83d2b9c2363eea21f34c31bb
-
Filesize
64.0MB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
64.0MB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
616KB
-
Filesize
616KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB