Analysis
-
max time kernel
300s -
max time network
304s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
01-10-2023 09:07
General
-
Target
˫װ.exe
-
Size
6.8MB
-
MD5
4e53a65f92a258aafe4654ad6ea14332
-
SHA1
ba11d19faa5f68f795d0355fa11091d3904889c1
-
SHA256
ec0029ed11e838c80c35da057f69ff7be9a01a9b1fa2246f530c49c2fa56e647
-
SHA512
04e125f3c99e81a9b227177f51c142818177e79642cfc93f2ecab9fc658c85aba2533718ad40583c85229bf280b05d9913bcb5b5f98d8f0e94c0cc736e352b30
-
SSDEEP
98304:3rr0GhfuHLZ9l8lJA8dHxv1x13pQCHZ66z24VZbR:br0GhQL7lwJzRv1x15Q4Z66z24VZbR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\˫װ.exe"C:\Users\Admin\AppData\Local\Temp\˫װ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\VQ0PCTWd\jkjcwtVs.exe"C:\Users\Public\Downloads\VQ0PCTWd\jkjcwtVs.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5f6bf82a293b69aa5b47d4e2de305d45a
SHA14948716616d4bbe68be2b4c5bf95350402d3f96f
SHA2566a9368cdd7b3ff9b590e206c3536569bc45c338966d0059784959f73fe6281e0
SHA512edf0f3ee60a620cf886184c1014f38d0505aac9e3703d61d7074cfb27d6922f80e570d1a3891593606a09f1296a88c8770445761c11c390a99a5341ee56478aa
-
Filesize
6KB
MD5e39405e85e09f64ccde0f59392317dd3
SHA19c76db4b3d8c7972e7995ecfb1e3c47ee94fd14b
SHA256cfd9677e1c0e10b1507f520c4ecd40f68db78154c0d4e6563403d540f3bf829f
SHA5126733f330145b48d23c023c664090f4f240e9bbeb8368b486c8ee8682ec6a930b73275e24075648d1aa7e01db1ec7b7e259286917a006ba9af8fb7cba3439070a
-
Filesize
358KB
MD5e8ac25f97a5b7d2483f5b90afcc84c5d
SHA105eff553dbef71e26a172d169bd39c2f07e4bbb5
SHA256ed6015ff5aa3c8fe1c21b22370b75e0ae49311cf4240cc1918214f0c63488bee
SHA5127e344acb84fcb7b4e1f2aade9389b3ee323b769b301e9f477a3a75b4e586dde83147a7656500a8fcedb5d021419d7f0e60f970b9aecac3fffb4b04e88c370638
-
Filesize
53KB
MD5c01854d7e6be8474cfccbfb8ecf81d0b
SHA1d5fb64c8e4e7c6bb1b5322ddd67e43974b20cf06
SHA256a31251575a2dcb37ab41d4cb0fa5704c60c66b784cacf101ddb07252044b3746
SHA512fcf768c89c8747e6a6a69f2ff99ae588b3662157f83039ce1209263878b63abf2dcf6f43dad72ec688f25332c87a1b09acb47d6e2ea5c62ce76592b942be2f9f
-
Filesize
132KB
MD5116cc84dce60ec0b3835c2ad1c2424a7
SHA1c171d7f80c2e6388563f5cdbe8f40e19b8e4a01a
SHA256d7fb488e57ab01b4b9066fa4aed702c541dc99b98b4804b5811d0cf377090c4e
SHA51203a29f6ac59cdefdf46247c2fe917d418541b814e5cbe3bdb47434ad88660eedcd3cdaa5f110840f9034d8ecf7b9f552564722445cb5a8fa441c3389a2ddaa93
-
Filesize
529KB
MD549d595ab380b7c7a4cd6916eeb4dfe6f
SHA1b84649fce92cc0e7a4d25599cc15ffaf312edc0b
SHA256207d856a56e97f2fdab243742f0cfcd1ba8b5814dc65b3798e54d022ce719661
SHA512d00ed0d9baae96ccbaf1262b4a4aaf4468e4ace6cebcea81e74d830bf414d9bc61068b8fb0eefa742add14aec47284f3adc11be26c8b8d66bfae4c498f2a4110
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
1.3MB
