Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
31/05/2023, 04:23
General
-
Target
29581cf5189942cc86cd1d4d87af7b7896d91ba8d889c251b0f346eb9bd336bf.exe
-
Size
2.0MB
-
MD5
ccce8d405e1248c31c36c848ef850517
-
SHA1
7e926e36bc11d6f0496db904b7012fbce7b99194
-
SHA256
29581cf5189942cc86cd1d4d87af7b7896d91ba8d889c251b0f346eb9bd336bf
-
SHA512
9f8412f269f7a71839be4bcd7f10c22991a1fb45631795c5b6f9ec3ec2df9f63f3d60ec76216a770953ff89ccd328138bc88f7def42b5038fadec2e386046564
-
SSDEEP
24576:ypwVibt/lAnm19fbHCGNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eK9mCy3KxW3ixPEmx7:ypwUttdGlxapGInW3Rm2vGaCJQ7
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\29581cf5189942cc86cd1d4d87af7b7896d91ba8d889c251b0f346eb9bd336bf.exe"C:\Users\Admin\AppData\Local\Temp\29581cf5189942cc86cd1d4d87af7b7896d91ba8d889c251b0f346eb9bd336bf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\??\c:\recovery\ClientDaemon.exec:\recovery\ClientDaemon.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\recovery\PcAssit.exe"c:\recovery\PcAssit.exe"3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
MD59ea5c430bba7600bdad6d0ffb6d01a4d
SHA197698db2d796f49ec45a611470e70a1e115f25a8
SHA2563d0b5ef8d36d3794311129c70888867ca7ce7b846e52e6e6d7bf0b8fd3738516
SHA512fb00d9eab5b82787796f5ebf237a8e121d3bf02e5ba0f5440ceecc86193b80412d360fc398c5a4de36085af8c58eec9afa3c196e0208ce44c27bb776fd04e40d
-
Filesize
73KB
MD52d7eb1dd4528eedb0f2335e18bdd7193
SHA169fa906f8ab2365dcc67476fce421e861dc99d4f
SHA2568ac6a364e101cce51638bec5e3d697301beb24bd4ecdbea8bf7cbc4b537465a2
SHA5120d53f93dae58b15193c48b670c0c788d996e68d9c217f9105a84dfdad2fc776764b2d9d2427eba5b698628911a90e2f7b7e474549acf0e864936910ce42aa95a
-
Filesize
254KB
MD532cec41c0caa5fb23b08980ce67d3039
SHA16a5423915e0c8e3da44d92ec8d81de7dc430dd65
SHA256cfef8204eb057245a9e26d56ccf1d83c8dc0f10d62f5347f15edf215f8a21013
SHA51298857976f93b75ccacb8e96d669617bfb17a3e37492b1ed83bd914f6ff1aeca233188473d77c67e3947e0eeac81cb3db8b9e00e87144e372f03e62c01513bdb8
-
Filesize
200KB
MD59ea5c430bba7600bdad6d0ffb6d01a4d
SHA197698db2d796f49ec45a611470e70a1e115f25a8
SHA2563d0b5ef8d36d3794311129c70888867ca7ce7b846e52e6e6d7bf0b8fd3738516
SHA512fb00d9eab5b82787796f5ebf237a8e121d3bf02e5ba0f5440ceecc86193b80412d360fc398c5a4de36085af8c58eec9afa3c196e0208ce44c27bb776fd04e40d
-
Filesize
73KB
MD52d7eb1dd4528eedb0f2335e18bdd7193
SHA169fa906f8ab2365dcc67476fce421e861dc99d4f
SHA2568ac6a364e101cce51638bec5e3d697301beb24bd4ecdbea8bf7cbc4b537465a2
SHA5120d53f93dae58b15193c48b670c0c788d996e68d9c217f9105a84dfdad2fc776764b2d9d2427eba5b698628911a90e2f7b7e474549acf0e864936910ce42aa95a
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB