Analysis
-
max time kernel
147s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
16/08/2023, 04:03
General
-
Target
45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38.exe
-
Size
10.4MB
-
MD5
3c38b13a0e7dae80caf79fb91a92ea32
-
SHA1
d28ff30afe1b6f1d9c431f3a61dc753fbc397654
-
SHA256
45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38
-
SHA512
bf42af7bfe07e0b0c9dd7524f0a1fa37f596a68f55e1dc186899742a83b27b7a675c4c9046d689ed26d3ef210300e203dc93d87239761e5b0b7264ad2626c814
-
SSDEEP
196608:jpPaI0j0GGXh1toX6qVJbEFm7eEfXIvCegxuxBLxXKzUMvYySFDzVXEtRr:jpzxGgdoHEFmyEfXG+xuxFxcUpyuDxEX
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38.exe"C:\Users\Admin\AppData\Local\Temp\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38.exeC:\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38\45db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.4MB
MD53c38b13a0e7dae80caf79fb91a92ea32
SHA1d28ff30afe1b6f1d9c431f3a61dc753fbc397654
SHA25645db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38
SHA512bf42af7bfe07e0b0c9dd7524f0a1fa37f596a68f55e1dc186899742a83b27b7a675c4c9046d689ed26d3ef210300e203dc93d87239761e5b0b7264ad2626c814
-
Filesize
10.4MB
MD53c38b13a0e7dae80caf79fb91a92ea32
SHA1d28ff30afe1b6f1d9c431f3a61dc753fbc397654
SHA25645db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38
SHA512bf42af7bfe07e0b0c9dd7524f0a1fa37f596a68f55e1dc186899742a83b27b7a675c4c9046d689ed26d3ef210300e203dc93d87239761e5b0b7264ad2626c814
-
Filesize
37KB
MD51fe0fa112546f4f9fba211614c362157
SHA157dbf040498365fc1f0377097309dc96219ac3fd
SHA25673603bb9dbcdadc9381cd41e08c4b91179c6d769fc0826b9f762009ba2f5e9d8
SHA512bf9cea4622d30445cab990ffbe63a0bd6d025f76c040fbf6f4d36637293d0d4644f00fd0e01c9a4cc691dcd6d5e1e35e9270280df88f346b5b618ab9c0caa928
-
Filesize
2KB
MD5c3eb0e73b0b2c269c9240cc8cf07a2c4
SHA1d2d8d49b56ebdad765388204fc9f0d50045735ec
SHA25625c9b9257f54fb752925d1710beae02de0079a99c189abd48bffc5bf8c48a614
SHA512e784dafd354320af18e1ad3db874941153124f337f2df9091811771e0f4254b9c6bc95d861e5ee8523b144f96faf669c9857622dd1acbed5060fcbd03861985f
-
Filesize
68B
MD5d6d29cdd72725603b6e9d9adfa3dd730
SHA1551456c50d76ea0d079a32e9740bbf6bb5be1903
SHA256f5446a01ce00bc25763ab7231af3da28c5fe3ef704c24643c0885b8b24f7175d
SHA512ada83328a3f15dc9c5c25f5155e688e7cf877d08f27e114e9f384f666f22fc7f5eef0bb0800fbd6fb35d2240d927de8b96e03adca7b55352bc47b34ba3903d35
-
Filesize
102B
MD52f5ca487095d30f58bddd2fab670416a
SHA1d1deb416b175102cdd7fc7eb81a4fa56b4bee884
SHA25622c0288cd34750a46168ee2a4407a54f45948cb23bf238b409de6c0202f77c91
SHA512eab37322adc74dab0c2315fdd514c9428fc8583d848be7cdb6d3d23f02c93fef8b0e0450229fafaaee5a9d379ae6ce711b7c6ab728de950e394e16456b52e29a
-
Filesize
10.4MB
MD53c38b13a0e7dae80caf79fb91a92ea32
SHA1d28ff30afe1b6f1d9c431f3a61dc753fbc397654
SHA25645db0f018bc56d4b21174ac0c7ee3957c2d4d6b2aad4583d3a9fa894f90b3e38
SHA512bf42af7bfe07e0b0c9dd7524f0a1fa37f596a68f55e1dc186899742a83b27b7a675c4c9046d689ed26d3ef210300e203dc93d87239761e5b0b7264ad2626c814
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
12KB