Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
20-09-2023 01:26
General
-
Target
06717b2d323266fcaf47484058df07be3610c5eb113754119913a183ebff22cc.exe
-
Size
80KB
-
MD5
22ae85ec72eb9675462270044176815e
-
SHA1
9c73eae8388ae7c90b92e995283913ee964597ac
-
SHA256
06717b2d323266fcaf47484058df07be3610c5eb113754119913a183ebff22cc
-
SHA512
9ea5bbb1e6f67db0126815c5bf62bd52048c646dab12e0183f66465be07f4c261dd7a6b0a7235d0befdfd2476f52c7b31fd38b6d8d010ed79bf2f149495b3685
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOVr:RshfSWHHNvoLqNwDDGw02eQmh0HjWOt
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06717b2d323266fcaf47484058df07be3610c5eb113754119913a183ebff22cc.exe"C:\Users\Admin\AppData\Local\Temp\06717b2d323266fcaf47484058df07be3610c5eb113754119913a183ebff22cc.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD5f549b8e2b81a50dff54895900e68d724
SHA118a29834dc415358bd048dd0a6116c59b9e027cf
SHA2565b7f069282ee6efaa1110c4198b85eaf7acab93e4631c6f25f66d904ba2c6416
SHA5120cf8833c3e9cbad366f7622e2c37c8103d68dacca2d5eff89647fe2faa79f5399232ca67aaadcc71bd76986c47cdbf9845053072fa52449435d6fc82dbbcbca5
-
Filesize
74KB
MD551ccd8cf94ec1bc40d165cdcf91c0f00
SHA10de505c7a192f2f41525b545f9a9cded736b591b
SHA2564eac23f257f546be9d6484a0b7adbf36a70406659754bb5f5551dcb088181fb8
SHA5128a15eaf4571807e07fce7909dc9b5b71cb00d2d92bd553a484b5a88a40f5ad961edd6761b7aa7039f9e06f9fab5d18b27b863b8998b7257e009a890a67a6679f
-
Filesize
74KB
MD551ccd8cf94ec1bc40d165cdcf91c0f00
SHA10de505c7a192f2f41525b545f9a9cded736b591b
SHA2564eac23f257f546be9d6484a0b7adbf36a70406659754bb5f5551dcb088181fb8
SHA5128a15eaf4571807e07fce7909dc9b5b71cb00d2d92bd553a484b5a88a40f5ad961edd6761b7aa7039f9e06f9fab5d18b27b863b8998b7257e009a890a67a6679f
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB