Analysis
-
max time kernel
190s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 22:02
General
-
Target
667141fd61489bade500be627893096cbb06282deec397f36818f497f9421626.exe
-
Size
78KB
-
MD5
b3de9396afc76aba1b3a848268d51ea5
-
SHA1
742eb5b6dd49db180f45c60b763834631bd5176c
-
SHA256
667141fd61489bade500be627893096cbb06282deec397f36818f497f9421626
-
SHA512
b285bdf6d6190ddc86a78e78a0b81558bfac2725e16fffd767ad0ea72f3c81630c6bff0154b8fe8b044d0014a248ca891ac3ddcc90790ca3caac5b4d9d11ff38
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWOUj:RshfSWHHNvoLqNwDDGw02eQmh0HjWOq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\667141fd61489bade500be627893096cbb06282deec397f36818f497f9421626.exe"C:\Users\Admin\AppData\Local\Temp\667141fd61489bade500be627893096cbb06282deec397f36818f497f9421626.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5cf81bb3c509e55f2b83990e02bb301da
SHA1eec4c6e09ff42920616c5d13c2bf3aa11ee633ba
SHA25639aebdaf6a398c9b87b3b7f054060364f30d62c984ee588debeb27cb0d27aef8
SHA512a1442bf176137f7adbfbf6bfa1f9f25526fdf08b4261d8268d2c9f6f0b05cc0eb1108702d1846252b01a112407de7ee121fe5a45047e16dba3c5b917d0b63395
-
Filesize
77KB
MD5fb87bf75eecfe1aceabc59ba7a270db4
SHA1375f8dae77ac79aa3b7a5527a5f2c93cca2a29a2
SHA256bb96f04ba9e174d8f0526e0971cb12ad1a7e7841664d3ca6ff10ec358ce1636f
SHA512da06b087990dac5bca190b2fe3d68163e388ba79199bf4263ede02f1c447402d3cc7023d01838cba4b0f137c2d113a2c7b57a1d11168f71feb30642a3deccef9
-
Filesize
77KB
MD5fb87bf75eecfe1aceabc59ba7a270db4
SHA1375f8dae77ac79aa3b7a5527a5f2c93cca2a29a2
SHA256bb96f04ba9e174d8f0526e0971cb12ad1a7e7841664d3ca6ff10ec358ce1636f
SHA512da06b087990dac5bca190b2fe3d68163e388ba79199bf4263ede02f1c447402d3cc7023d01838cba4b0f137c2d113a2c7b57a1d11168f71feb30642a3deccef9
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB