Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
-
submitted
03/09/2023, 19:34
General
-
Target
dd2f99d08a4d753c064d136cca18a34c60e18695e670841a6631c7d39a8099c2.exe
-
Size
81KB
-
MD5
cf4601b929f06f13d87483faa2632119
-
SHA1
095d7e679104bf656a9ab26cd1aa1cc4d5f1ebcd
-
SHA256
dd2f99d08a4d753c064d136cca18a34c60e18695e670841a6631c7d39a8099c2
-
SHA512
4a43374d0ef4ffe8e35e0f114d1ed6422b8172d69b2067f8ae089b36dce012cfbebe042ce8500f0623d49a6164d6b25d934a86c6a6e5e811083136f83fea6739
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOGtd/qWmpWOaP:GhfxHNIreQm+HiBtd/qWmpWOaP
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2f99d08a4d753c064d136cca18a34c60e18695e670841a6631c7d39a8099c2.exe"C:\Users\Admin\AppData\Local\Temp\dd2f99d08a4d753c064d136cca18a34c60e18695e670841a6631c7d39a8099c2.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD54bf01f291ecba6ed7c06a9c3b1db1e2c
SHA1533c1ee77b322a67b704433b37bf878ce901b0af
SHA2560a8112a7e2babf0e200ad90ec4201e15e712547ef0382bf9d5a0b32728d3ad1e
SHA5125524392cdbc28128d1e13e10fbdf9dbfcc60708dda94925426c892262776cbb115419399ed8241569d215efc1fcd4cf2140bb0a9854031c662a4728354027be1
-
Filesize
84KB
MD56ec91d78247899a2da51e314eba79b2c
SHA1b02c3fc7f2ed25b616ab3f863a22e916bc5e605c
SHA2568520967ee3561104e22536fa18d2fbc6c3461b38c3288f824496471d0ae0b8d1
SHA512b0b3ebef4e8a875aa573abfc698043f21d2ff4bef9a00b247341ed8935bdbe66ba75fab35c1dc37a5c35ab348d9bb063e6d79845aac46ba77fa3ed4b82b1392c
-
Filesize
84KB
MD56ec91d78247899a2da51e314eba79b2c
SHA1b02c3fc7f2ed25b616ab3f863a22e916bc5e605c
SHA2568520967ee3561104e22536fa18d2fbc6c3461b38c3288f824496471d0ae0b8d1
SHA512b0b3ebef4e8a875aa573abfc698043f21d2ff4bef9a00b247341ed8935bdbe66ba75fab35c1dc37a5c35ab348d9bb063e6d79845aac46ba77fa3ed4b82b1392c
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB