Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
24/08/2023, 19:48
General
-
Target
e278dc1880b18ea4f28819b05154830a8875d4f4f34baa7604a0f131708f382c.exe
-
Size
84KB
-
MD5
6b0eb3ded61880bac6ffe00bde083929
-
SHA1
11a63fcea3a5d322e3ba963cb01aaa24cb5a47e2
-
SHA256
e278dc1880b18ea4f28819b05154830a8875d4f4f34baa7604a0f131708f382c
-
SHA512
d93c5b08944622261fe25b7315c4100044a43a29c5bba79f09057845e559cdec31c22e05d9ffb907c1c5d013dc8bc997d095388f29ccc1e8c726b4931bdfdc15
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOOE3g4yrKgjsk/OdfHX/:GhfxHNIreQm+HihE3g4yrKgjsk+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e278dc1880b18ea4f28819b05154830a8875d4f4f34baa7604a0f131708f382c.exe"C:\Users\Admin\AppData\Local\Temp\e278dc1880b18ea4f28819b05154830a8875d4f4f34baa7604a0f131708f382c.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD557917c637878ef5d208a904bec59cc25
SHA1eab2e91d73a919e2b8d8f7ddb4d00cb0e2e03188
SHA256ef1f85bb7b78134a134e33293be2b2269a40e6a064bd1661a9973486f3a6c7b1
SHA5121844983604a7e7b0b6044f3b74b2b9694e30d13ee3efbdccbe3851c5e03775adac0d25adab3abddc664c5a21922ee624f1241023252ad3cb5f8ee6b1f74015b0
-
Filesize
82KB
MD5983eeb142f1c4f3b5fe6f66fb52d9cfe
SHA161ec395df55e46bd14db2d997909e551ffda68e7
SHA2564eee2c6e8da20f6d4b41164dcd3a9f15e941995d90967be184174acad965fdf0
SHA51291a3230d51104567aee910bf037db1127aa72c978b3bf3340f7c94bfcb63fd25c70a96ad440deab697340dd0613c852737a8295ec54937f8b76189a14219a210
-
Filesize
82KB
MD5983eeb142f1c4f3b5fe6f66fb52d9cfe
SHA161ec395df55e46bd14db2d997909e551ffda68e7
SHA2564eee2c6e8da20f6d4b41164dcd3a9f15e941995d90967be184174acad965fdf0
SHA51291a3230d51104567aee910bf037db1127aa72c978b3bf3340f7c94bfcb63fd25c70a96ad440deab697340dd0613c852737a8295ec54937f8b76189a14219a210
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB