Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
28-05-2023 19:19
General
-
Target
tmp.exe
-
Size
660KB
-
MD5
9a3e1eee1cc88d5e7955f8a42f9cce61
-
SHA1
817e02a3ce12dda64703d29c2ff2de7d882dee82
-
SHA256
f450e7ab58e7ec8298127012ccc234e08f52fa004f579ab44459dcf081862824
-
SHA512
4a870fbd5a941db961c4f0444f44193c36c1eb9f0e55f4bd3de937204f5d461367f05f024052bece87b5cc24ca7c4039e72afa3810bfabedead16a87e056e34b
-
SSDEEP
12288:8HLUMuiv9RgfSjAzRty26xGJeMTE3Z2ap4srKWLZ6JCtXZYJfme:WtARD6EAMC41o6Jfme
Malware Config
Signatures
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5c56e7fe3064647acf29cc3602cdb8a08
SHA19ebd7913801303341781910a78e49c8bd7bec793
SHA256fe8ce7c137aaf654dfd3b8a1aed37698da503ad519c4b4bfc9d47708afefbec0
SHA512a443c2996bcaeab2a824f37eb74fb4b964816b54e2e0e619a451c9ff51418fb02430479ed841a1d54dda0ac68373a03f62b98e81458708cfb79361186193851f
-
Filesize
9KB
MD5e3ead1177ce2090c5e123a6990b40598
SHA166d8602e42e215a58287930692e6944a2e428acd
SHA25614c38337872ff297567e961dd29363556f9fc433efa8fdeb85f61c048cddf235
SHA5124f49b9071fe8f60e093e6fb52ed7c6cf0997f0038f7c799d08312d93462afa1137d9bd95b23ae8789a8aebe8d25065d5b5928c35c1f75726ff043b8977ee053d
-
Filesize
3KB
MD5408517d48b642ac8ce921f1be818eece
SHA1061d596b0a57fa26587fff15042fd87168e90b05
SHA256234d92c63572769b6af6c3a0e3154679650a9b574a809d12660099c20cd389da
SHA512eca5a8eb92fbd110a0d1763cc87e14b579cda57161eede271c305cb4dc33ef742450fe274d05f2a08ecd09f7785d2be131e8706ae0d20b33c0090f4a0dd28cbb
-
Filesize
9KB
MD5e3ead1177ce2090c5e123a6990b40598
SHA166d8602e42e215a58287930692e6944a2e428acd
SHA25614c38337872ff297567e961dd29363556f9fc433efa8fdeb85f61c048cddf235
SHA5124f49b9071fe8f60e093e6fb52ed7c6cf0997f0038f7c799d08312d93462afa1137d9bd95b23ae8789a8aebe8d25065d5b5928c35c1f75726ff043b8977ee053d
-
Filesize
9KB
MD5e3ead1177ce2090c5e123a6990b40598
SHA166d8602e42e215a58287930692e6944a2e428acd
SHA25614c38337872ff297567e961dd29363556f9fc433efa8fdeb85f61c048cddf235
SHA5124f49b9071fe8f60e093e6fb52ed7c6cf0997f0038f7c799d08312d93462afa1137d9bd95b23ae8789a8aebe8d25065d5b5928c35c1f75726ff043b8977ee053d
-
Filesize
10KB
MD50e9caee9767989c220f2a671a9e6ca60
SHA199e0a3e7b98ed3500121697942f6b7bbf4df88aa
SHA256881982af78c434328c71ad286b11f4d05e7424a31081b7fed09895e0d81ca9ec
SHA512ec1dcb7aae84085c9a5eaef54b3a8550c2631268b60fcccdc962afad0351ca9a395fc492ca3902998fcea9230083458873191dbe7da040ef82f4f076b6864069
-
Filesize
954B
MD5b4983c1aa57201d8866994cdbd8e8af8
SHA1b963a5dec73daa8676520ef15faf484cee9dfe4c
SHA256e182b5459c11004906d3e528e55f713e7c8602e006810fdce003bfd0f64c7c29
SHA51231252c4717be4c3e8eab5c56504e9065d05fd92ae75fcf849a3e6b8f1d1f81847a77b88ca7bee53551eb651d29d7be5906a55958d26e916b89b3e03e0a1f5414
-
Filesize
107KB
MD52d03ff1b012497ff72fe803b4617b9e9
SHA10295e20a4727ae30b386a943e8870b4466664d7d
SHA2563596e8fcb1cd8510afc78c5724ffe5741c3bcc149c03ff8ed6e227902275afd7
SHA51261436da13151a8bf214c933c7f7de266000bbea3ad261a6fe8c74256e7caf7d7f20209c4c8659bbe2b49d62fec840f62464c416980d4939bf783e742b1277922
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB