Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
-
submitted
27/08/2023, 23:42
General
-
Target
user.exe
-
Size
1.2MB
-
MD5
4d9fd21aa87a2eb1bcad4d9dff0c6362
-
SHA1
9074fad1d75cb2612d16b3d6794fe97112cc8a82
-
SHA256
02a7ad63210fdb04980ce442aadbad7c40086c063fc037eb7eddc72f09da7c43
-
SHA512
a07683f97e46749dc2db66874b2daedd7e11fabf76e1a34998c1784fdaa229e1294cff7b12967afc8650af2cf3cbb86d37a9a1e8c254f8cbdc9092f46d4fc5be
-
SSDEEP
24576:EnsJ39LyjbJkQFMhmC+6GD99bC1kzMc0z3:EnsHyjtk2MYC5GDzuizMcw3
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\user.exe"C:\Users\Admin\AppData\Local\Temp\user.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_user.exe"C:\Users\Admin\AppData\Local\Temp\._cache_user.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD54d9fd21aa87a2eb1bcad4d9dff0c6362
SHA19074fad1d75cb2612d16b3d6794fe97112cc8a82
SHA25602a7ad63210fdb04980ce442aadbad7c40086c063fc037eb7eddc72f09da7c43
SHA512a07683f97e46749dc2db66874b2daedd7e11fabf76e1a34998c1784fdaa229e1294cff7b12967afc8650af2cf3cbb86d37a9a1e8c254f8cbdc9092f46d4fc5be
-
Filesize
1.2MB
MD54d9fd21aa87a2eb1bcad4d9dff0c6362
SHA19074fad1d75cb2612d16b3d6794fe97112cc8a82
SHA25602a7ad63210fdb04980ce442aadbad7c40086c063fc037eb7eddc72f09da7c43
SHA512a07683f97e46749dc2db66874b2daedd7e11fabf76e1a34998c1784fdaa229e1294cff7b12967afc8650af2cf3cbb86d37a9a1e8c254f8cbdc9092f46d4fc5be
-
Filesize
1.2MB
MD54d9fd21aa87a2eb1bcad4d9dff0c6362
SHA19074fad1d75cb2612d16b3d6794fe97112cc8a82
SHA25602a7ad63210fdb04980ce442aadbad7c40086c063fc037eb7eddc72f09da7c43
SHA512a07683f97e46749dc2db66874b2daedd7e11fabf76e1a34998c1784fdaa229e1294cff7b12967afc8650af2cf3cbb86d37a9a1e8c254f8cbdc9092f46d4fc5be
-
Filesize
435KB
MD594a415594e19333d35e93cb877973ad5
SHA17c09b0932caf621fc90fe269ceabf6b4fd2e55f2
SHA2565e0fb6d1301c00001b3b3158c822ced6173548b0b85953577f6527431d5fc71f
SHA51232d60355bbe3ea1a80ad84e054a07ae4ea9b3c8607dc435744fe1dfdebcc9dca83b6ce954d693fb2791044236c07a71f428f1fee2bf478f112c90bd2889038c3
-
Filesize
435KB
MD594a415594e19333d35e93cb877973ad5
SHA17c09b0932caf621fc90fe269ceabf6b4fd2e55f2
SHA2565e0fb6d1301c00001b3b3158c822ced6173548b0b85953577f6527431d5fc71f
SHA51232d60355bbe3ea1a80ad84e054a07ae4ea9b3c8607dc435744fe1dfdebcc9dca83b6ce954d693fb2791044236c07a71f428f1fee2bf478f112c90bd2889038c3
-
Filesize
435KB
MD594a415594e19333d35e93cb877973ad5
SHA17c09b0932caf621fc90fe269ceabf6b4fd2e55f2
SHA2565e0fb6d1301c00001b3b3158c822ced6173548b0b85953577f6527431d5fc71f
SHA51232d60355bbe3ea1a80ad84e054a07ae4ea9b3c8607dc435744fe1dfdebcc9dca83b6ce954d693fb2791044236c07a71f428f1fee2bf478f112c90bd2889038c3
-
Filesize
435KB
MD594a415594e19333d35e93cb877973ad5
SHA17c09b0932caf621fc90fe269ceabf6b4fd2e55f2
SHA2565e0fb6d1301c00001b3b3158c822ced6173548b0b85953577f6527431d5fc71f
SHA51232d60355bbe3ea1a80ad84e054a07ae4ea9b3c8607dc435744fe1dfdebcc9dca83b6ce954d693fb2791044236c07a71f428f1fee2bf478f112c90bd2889038c3
-
Filesize
435KB
MD594a415594e19333d35e93cb877973ad5
SHA17c09b0932caf621fc90fe269ceabf6b4fd2e55f2
SHA2565e0fb6d1301c00001b3b3158c822ced6173548b0b85953577f6527431d5fc71f
SHA51232d60355bbe3ea1a80ad84e054a07ae4ea9b3c8607dc435744fe1dfdebcc9dca83b6ce954d693fb2791044236c07a71f428f1fee2bf478f112c90bd2889038c3
-
Filesize
17KB
MD5e566fc53051035e1e6fd0ed1823de0f9
SHA100bc96c48b98676ecd67e81a6f1d7754e4156044
SHA2568e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
SHA512a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
-
Filesize
1024KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB