Analysis
-
max time kernel
161s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
19/08/2023, 12:21
General
-
Target
3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6.exe
-
Size
11.4MB
-
MD5
c3ff781f8e11d548af1e13c5804f88a3
-
SHA1
e24e84a693914c3c3ffe354fb6720a725c4b7b95
-
SHA256
3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6
-
SHA512
a23cf49b5a84bff4903e903e3d5e00e6c13082752ddf06d2586e884248d1362bc3c08bb6ea78182c8a1bbe941211353e19ee504ba54cbcb2d0b538f830e80354
-
SSDEEP
196608:jpPaI0j0GGXh1toX6qpZLEkeHaC8h06T9S3QxshY033boETZWIE+jAmlgw17CDTl:jpzxGgdo8keHQK6Je/hY0HkEd6mqw1Gl
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6.exe"C:\Users\Admin\AppData\Local\Temp\3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Å̹ŻðÁú\3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6.exeC:\Å̹ŻðÁú\3f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5252074dd4a89128c116c82bae39aecca
SHA16cfe434abf9e0c36ed83f5a26cb7d8a2f3054df4
SHA256fcacb616a8a1f3ca4a7ee3acbdd5653ee88ea0fb886f7593bee12c56bb498695
SHA512b6385e8f10a994812088e173c25d3aaa31c7fb0376916ba81f383918f8e77b8c07b1ab85d7588a5e42d625d2904cb819a445127b8c36c25d69ec267e4a79a2a5
-
Filesize
2KB
MD5d9cec07521f3d14e1d43991bf04838b6
SHA1dc8bae42a97724e9507558b6a9243e4f10cf3496
SHA256d777e0fe6b180f8c76d310f8a2c5b2be44a7d35d3898ad1af058385e0bf9441c
SHA5122bc9a5960e8e8c5db7e9e6690f4f285015ee83a46acbc8c66d0d21a0691b28383e7db50af608c107784c208feed1da76b917591df86df5dc35c84f227b6158a3
-
Filesize
12B
MD5b939451ae28835685f71af726a6f5fcf
SHA10d1234ae007268d660ffe03120e6d6f134d4da48
SHA25621e247dfebb64855ee18f663a08264207c506074ff69668a3d8503e8a1a02640
SHA5126d31c158f9e5679c086019c5115235fda25339acc1643748c814956918bf5d0b73320ee0c50f7aacbcbd75a4ef8999ffdb0c6c959911d5c238f8bcbdc0a87c61
-
Filesize
102B
MD520a60f98556f6a44df8f29a6f309ea4a
SHA17834f5122403ea21df8da22e44c0269c1ed7caa4
SHA256b56480ca1307a8521be10230c71a61e5cc4c9f608e551fc076ee68520e4dd9e7
SHA51291347655cdc40aa8e69b77d5d67b79784cf83172eb3703909cf690b8443e0afb9d3e0419c852db2f88e437d42345a7a3a640c9f9b2f58bd6fc7dbdc0ee81c59e
-
Filesize
11.4MB
MD5c3ff781f8e11d548af1e13c5804f88a3
SHA1e24e84a693914c3c3ffe354fb6720a725c4b7b95
SHA2563f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6
SHA512a23cf49b5a84bff4903e903e3d5e00e6c13082752ddf06d2586e884248d1362bc3c08bb6ea78182c8a1bbe941211353e19ee504ba54cbcb2d0b538f830e80354
-
Filesize
11.4MB
MD5c3ff781f8e11d548af1e13c5804f88a3
SHA1e24e84a693914c3c3ffe354fb6720a725c4b7b95
SHA2563f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6
SHA512a23cf49b5a84bff4903e903e3d5e00e6c13082752ddf06d2586e884248d1362bc3c08bb6ea78182c8a1bbe941211353e19ee504ba54cbcb2d0b538f830e80354
-
Filesize
11.4MB
MD5c3ff781f8e11d548af1e13c5804f88a3
SHA1e24e84a693914c3c3ffe354fb6720a725c4b7b95
SHA2563f1d85d9c3020e8f5d5ae29a5af347158571ff1f959ca0d7bef9b42a40c0e3c6
SHA512a23cf49b5a84bff4903e903e3d5e00e6c13082752ddf06d2586e884248d1362bc3c08bb6ea78182c8a1bbe941211353e19ee504ba54cbcb2d0b538f830e80354
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
12KB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB
-
Filesize
6.0MB