Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
21-09-2023 23:27
General
-
Target
1187a074ceb66e63bbae1100b070125ab70e6d08748bfd0d5c6a3ac3257c75ea.exe
-
Size
75KB
-
MD5
d59a3252300a3895894f75e2c64f9b41
-
SHA1
1e2e7005350aecde985510403a381fcdfcbcce51
-
SHA256
1187a074ceb66e63bbae1100b070125ab70e6d08748bfd0d5c6a3ac3257c75ea
-
SHA512
f8b482fb70212ae1990ce7450f100d0a13377acf57daeedc3f2ff418c751da755d1372e3b6e6e718504ab908845461a95354df5ea78278b731cbf4782c0850f1
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO5qya:GhfxHNIreQm+Hiaqya
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1187a074ceb66e63bbae1100b070125ab70e6d08748bfd0d5c6a3ac3257c75ea.exe"C:\Users\Admin\AppData\Local\Temp\1187a074ceb66e63bbae1100b070125ab70e6d08748bfd0d5c6a3ac3257c75ea.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD55a32558fb97a6fd5a6f4dfe4c7614c04
SHA1886bd2337ddad6aecd10a6b0625d6181e4ebbbfa
SHA256078d022cc7a429c19d532d1440ee341ba4c4ed72b0d31c1322f970006f6af58b
SHA512f82b335c2c43336bc875632febdb8d378dd7bc6e0a798a5babc41d62b0538755cd82faff5b1d7157df1af64346575124404451a75eec44b3b957220241a6262a
-
Filesize
81KB
MD5e62e539a500552421d5e3488165b0a7f
SHA18be2f4eb88913acdaf3fe5a21f37a3fb75681e71
SHA25608688d24ad1bb21129691011ea0bd9a14cb203c165e14c636e259a77a9e14d2d
SHA51293faceb53e53482f287f18917edfe3bb77d9ae0ea7554593fb370f46082d6c0f075c6b587d752f0a24f25dafc8e7e290ee7337c090a4879ca3d02914baebdb9a
-
Filesize
81KB
MD5e62e539a500552421d5e3488165b0a7f
SHA18be2f4eb88913acdaf3fe5a21f37a3fb75681e71
SHA25608688d24ad1bb21129691011ea0bd9a14cb203c165e14c636e259a77a9e14d2d
SHA51293faceb53e53482f287f18917edfe3bb77d9ae0ea7554593fb370f46082d6c0f075c6b587d752f0a24f25dafc8e7e290ee7337c090a4879ca3d02914baebdb9a
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB