Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
23/07/2023, 18:32
General
-
Target
NA_NA_246c4678314ee4exeexe_JC.exe
-
Size
2.4MB
-
MD5
246c4678314ee4489631d95ec05fe067
-
SHA1
20a93f8d49979ea42e4a929be47c742fd92fc38e
-
SHA256
72bf544125dc2a21ed0951e06b630fa25605bf3b06194fc81e576c216c5c3996
-
SHA512
7ed1d4a1e665603c4abec410021718a911b518fbecb8d6ca7d93db385f6a6141fab4608e480c967a828c238f50a606e121973337f150e405a8cfc8be66c492d3
-
SSDEEP
12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCN:eEtl9mRda12sX7hKB8NIyXbacAfm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory 3 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NA_NA_246c4678314ee4exeexe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NA_NA_246c4678314ee4exeexe_JC.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
MD531df3f5eee2f9fed7f7da51d3d29739e
SHA1285924724a2966db2ec7183d40032987a88db70a
SHA256dcd45793a32516b18562a3fb3de080706f9c3a4baacd01b743da08f5318dc85a
SHA5120c07211b0b8f53d6716a782ea885188174353c956bd7c7b794d119c329ea90b9771d63aad189714bf2ae581fb9f655d1ce516f0749fcdb58cbec2e6e1b95b6ee
-
Filesize
3.2MB
MD5f83b2625b3af71101799e4f6a5921b16
SHA105b34bc96adcb28c7d46e12a1f2aa73ffa585ee6
SHA2562c7f20f1907bc54be4d1557d91e782b0f8600cb34d5f3961a0c748ef4df8e42b
SHA5126218380721dcd2f012b4f0966842d3ba8314ee980d9bff24e3d2e403f56a1576e3b6967892943e13566679f810d106aa390cc9ee8845df8ee8c307a93059637d
-
Filesize
1KB
MD55103c35a52535c97bf2eb80e267bbdb9
SHA12ac85ec767f0e0b62d01fd46dbc2c334c3d5d2c1
SHA25695fa0c2f8a05289db76cc490b27bdb53e060bc6b09e4888464fb6fa5bc9b9b84
SHA512fd945e3ab8393f4aec95db21e9d1fc41c9a8d5702e9ac457ae3ec95efd4b1454aecaef3852e95f9bfe1e2dc4f6a707445ad5cd35bd3474c61355de2d041dacf6
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
4KB
-
Filesize
492KB
-
Filesize
492KB