Analysis
-
max time kernel
308s -
max time network
320s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
01-10-2023 09:07
General
-
Target
ٷѰװ.exe
-
Size
6.8MB
-
MD5
d29e0172941811344a23c7bd23701942
-
SHA1
ae606314147c0929bfc3beac462a6d914ebf9bff
-
SHA256
2229caa63c12cbb42cb66a6644cd4b88c74b440c133df37ec1d0e32e3db67bcf
-
SHA512
c0f7434326e0a4b99a583dd44344b73cd4ea74a4f11c85cc8def201137f299499b54e63cbcb1df2f771976dd058c5b1213ea53a3fa76ad8eed0b6ad1a1b8958f
-
SSDEEP
98304:3rr0GhfuHLZ9l8lJA8dHxv1x1zHNCHZ66z24VZbR:br0GhQL7lwJzRv1x1jN4Z66z24VZbR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ٷѰװ.exe"C:\Users\Admin\AppData\Local\Temp\ٷѰװ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\6CTEQECS\E0FWEfIF.exe"C:\Users\Public\Downloads\6CTEQECS\E0FWEfIF.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5e39405e85e09f64ccde0f59392317dd3
SHA19c76db4b3d8c7972e7995ecfb1e3c47ee94fd14b
SHA256cfd9677e1c0e10b1507f520c4ecd40f68db78154c0d4e6563403d540f3bf829f
SHA5126733f330145b48d23c023c664090f4f240e9bbeb8368b486c8ee8682ec6a930b73275e24075648d1aa7e01db1ec7b7e259286917a006ba9af8fb7cba3439070a
-
Filesize
36KB
MD5f6bf82a293b69aa5b47d4e2de305d45a
SHA14948716616d4bbe68be2b4c5bf95350402d3f96f
SHA2566a9368cdd7b3ff9b590e206c3536569bc45c338966d0059784959f73fe6281e0
SHA512edf0f3ee60a620cf886184c1014f38d0505aac9e3703d61d7074cfb27d6922f80e570d1a3891593606a09f1296a88c8770445761c11c390a99a5341ee56478aa
-
Filesize
132KB
MD54149f0d8db7f8de3a56c630b9980bbdc
SHA1c3c642f00b270f7f10eb0ea7c5eefce17f0ea80b
SHA2565e7393708215984f021292743cfd59cb7fe2e03dd4d504663b19768efb4d84c2
SHA5125dd2e1fe0aa82d91b591fd4b01e180b9888ba4c8d36107d64bde32b42a959425e38bc15cf79b677eda3a6b7d6831acde7cac99622dd0ef834ad2258ced1d2921
-
Filesize
529KB
MD549d595ab380b7c7a4cd6916eeb4dfe6f
SHA1b84649fce92cc0e7a4d25599cc15ffaf312edc0b
SHA256207d856a56e97f2fdab243742f0cfcd1ba8b5814dc65b3798e54d022ce719661
SHA512d00ed0d9baae96ccbaf1262b4a4aaf4468e4ace6cebcea81e74d830bf414d9bc61068b8fb0eefa742add14aec47284f3adc11be26c8b8d66bfae4c498f2a4110
-
Filesize
358KB
MD51eea54e7d8da117c7f1ec5a647189832
SHA19c39c0ffee626a03f3712c327656708a46f85c78
SHA25690ba6b523b9d35cf2f1ca2e402eceeecf94cda78aa13a48a9e1e75c3687c97fa
SHA51265a0f9a618f524f950200bfb4f183fc0c7c9b5b8e0f4baf0d519f28e0e2f3f04e02ca805492ff43a235d272f3ea06adb3a825c9ee3c86ce10f4fb7640d29f755
-
Filesize
53KB
MD5a2d73bcfbf7df25ebc202742e6b8cbad
SHA18f6c17ad94766e4b2d3b59578d3b35b37e9b4ac2
SHA25607a4d9a2e853399163b3f8f0555b9ffdddf0f91697e3f7f9d0ca48115c43b646
SHA512ed6d6d2619e8bd640e5d16d5efed64857c044e12cc39209cdbf636ed1afc42d637061890a0ec2d39643a5a63345d77c7da2d34e2be6594f8fd76b7f7ee79851a
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
1.3MB
