Analysis
-
max time kernel
52s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
15/03/2023, 22:13
General
-
Target
e5.one
-
Size
130KB
-
MD5
988bb80f6edafdc366e89041c6874fbf
-
SHA1
577e6d8dd0ac07359746148a5a75c8da480df0d7
-
SHA256
acf8e5db17102daab91b1877be4d52b0fb91728e21919ef14b138051f7d6e1bf
-
SHA512
e1594f2348f4b169c94d86a3fabcd2e7cebb10e631fcb57c1f0b3dc1b88d5145e0485d39564493dc554abb49d592b19d8ed6aad1a5ac7c733ec9a88abb2431e0
-
SSDEEP
3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgG2:d6nInM8TXJ52
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 12 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\e5.one"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{AC6ADCCE-6F6D-40B6-A396-AFFF23034889}\NT\0\click.wsf"2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD545282862aeb428ffb5d4986704a8f4d5
SHA1fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
-
Filesize
48KB
MD5b7fc313714edd7866f4c76527282c2b5
SHA1c86217b46956933fae4a30483a63b33f34b8c503
SHA256b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c
SHA512038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7
-
Filesize
567B
MD5d055ce625528e448c61315eaaef5bb71
SHA1029df4c872b1c154f32e7fe94f434547c3ba6192
SHA25685bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705
SHA512705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247
-
Filesize
61KB
MD545282862aeb428ffb5d4986704a8f4d5
SHA1fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
-
Filesize
10B
MD57605968e79d0ca095ab1231486d2b814
SHA1a007b420d19ceefa840f0373e050e3b51a4ab480
SHA256493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
SHA512769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB