Analysis
-
max time kernel
300s -
max time network
303s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
-
submitted
30-06-2023 00:17
General
-
Target
8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.exe
-
Size
38.6MB
-
MD5
b0cce809fe88b73d7532373911c23bd0
-
SHA1
c50f7fd9bb65dcd350909e367865ebe9bff894ff
-
SHA256
8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf
-
SHA512
3ab841cdce17bc666e246fa61065eeda5f8c8d95d93045dac2036e566b8d708dd5119f16640a8dfc2f63d386d7d09ea0bd6b697642f67de5aae47a849daea33f
-
SSDEEP
786432:yC4PWjsUxcIIKD+0XXeWkePNwmALcekMhu9D+0h7lvWZ3gqL/xR5lQzzLE:yCcUOIIKD+YOWRPNwNTd6+wlvKVL/das
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
-
Drops file in System32 directory 8 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Modifies registry class 16 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.exe"C:\Users\Admin\AppData\Local\Temp\8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3O50F.tmp\8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.tmp"C:\Users\Admin\AppData\Local\Temp\is-3O50F.tmp\8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.tmp" /SL5="$9016E,39573139,814592,C:\Users\Admin\AppData\Local\Temp\8525c99383b0acaeed302488b50a36439b71083e851bb28b65a893bf8ed944cf.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5ce3b2ef0b07d1770ddd8fa09a34138de
SHA1d07d12411d4a95cd26701fe83eb6d90d81103eee
SHA25622e0e4420698350d18a6c02244c5fa1ff2c772eacb9e7019a8f212b479934386
SHA51202edc78f9b7c8ad01a79243bbc7b51d2b86fb650535d134cc06360519b49ed30241de5cb916ab0624098e2b2b4c94b246e0fcf19e513b4e526100d46db652442
-
Filesize
3.0MB
MD5ce3b2ef0b07d1770ddd8fa09a34138de
SHA1d07d12411d4a95cd26701fe83eb6d90d81103eee
SHA25622e0e4420698350d18a6c02244c5fa1ff2c772eacb9e7019a8f212b479934386
SHA51202edc78f9b7c8ad01a79243bbc7b51d2b86fb650535d134cc06360519b49ed30241de5cb916ab0624098e2b2b4c94b246e0fcf19e513b4e526100d46db652442
-
Filesize
127.6MB
MD5fd8304d231ca5513640145cabf30a301
SHA167ad3eaca6099311f4ca0f7d0faee89a94916107
SHA2564e061db8b40002e1e6c4c1fe513b1da50c63f639f407e17fc4e8cf4a9ec34e7e
SHA5127072499b21333880acf41abc1e8eec144ae6957d383dc6921eb97a3e61e8c97faa9037213d2d7fcfc5f3161dd8a33d2cfda81052446ea58b574d001ef497c253
-
Filesize
127.6MB
MD5fd8304d231ca5513640145cabf30a301
SHA167ad3eaca6099311f4ca0f7d0faee89a94916107
SHA2564e061db8b40002e1e6c4c1fe513b1da50c63f639f407e17fc4e8cf4a9ec34e7e
SHA5127072499b21333880acf41abc1e8eec144ae6957d383dc6921eb97a3e61e8c97faa9037213d2d7fcfc5f3161dd8a33d2cfda81052446ea58b574d001ef497c253
-
Filesize
127.6MB
MD5fd8304d231ca5513640145cabf30a301
SHA167ad3eaca6099311f4ca0f7d0faee89a94916107
SHA2564e061db8b40002e1e6c4c1fe513b1da50c63f639f407e17fc4e8cf4a9ec34e7e
SHA5127072499b21333880acf41abc1e8eec144ae6957d383dc6921eb97a3e61e8c97faa9037213d2d7fcfc5f3161dd8a33d2cfda81052446ea58b574d001ef497c253
-
Filesize
4.7MB
MD562a89e7867d853fee9ad07b7c9d64379
SHA1944a53602492187308352103d80ff27af1093abf
SHA256d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9
SHA5127f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0
-
Filesize
4.7MB
MD562a89e7867d853fee9ad07b7c9d64379
SHA1944a53602492187308352103d80ff27af1093abf
SHA256d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9
SHA5127f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0
-
Filesize
64KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
4KB