Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 23:47
General
-
Target
3b34d723f00c8c322130f997f72f53454963d7d3813ee357756ed1cdec16cfe5.exe
-
Size
10.0MB
-
MD5
1b6a8b995ea461a1a8cdb64a38baa07c
-
SHA1
b45f1005e628a252159db7bb24311cad3f3f2fde
-
SHA256
3b34d723f00c8c322130f997f72f53454963d7d3813ee357756ed1cdec16cfe5
-
SHA512
1d62c0f776b3179d9e7d7842077d26828a7455062b73cb89a4e2276366b038cc5b761d361e80aa5f735df1e5ccbf87f68f79f1e1a856f235de11625af8aaf63a
-
SSDEEP
98304:zp1tz8PLaf8MkZ4/0n5pqWWqUi1osiG+77/bOtIzZ+L8v13jt9001em:zpILT4ypRnLM7/bOCzB00wm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 34 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b34d723f00c8c322130f997f72f53454963d7d3813ee357756ed1cdec16cfe5.exe"C:\Users\Admin\AppData\Local\Temp\3b34d723f00c8c322130f997f72f53454963d7d3813ee357756ed1cdec16cfe5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÓÎÏ·µÇ¼Æ÷.exeC:\Users\Admin\AppData\Local\Temp\ÓÎÏ·µÇ¼Æ÷.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.9MB
MD5fb1333ee1a0e7b312bcc909e2f2ddd3e
SHA11a64210fd0065a02d4acb55f1545ffcb4f1eccf0
SHA256eae56534dead3aacec847140b248414fe32ab9b70ff5990197d52b80aadfd86e
SHA51269b9fea21bd3a36bd85441b9d6bf84b06cc0e1046b9ee648ba7079e964129708735a5c81a4bf27c3f304e02b706cf8c3c932fc6b23a5ea7753a208ec6edda191
-
Filesize
7.9MB
MD5fb1333ee1a0e7b312bcc909e2f2ddd3e
SHA11a64210fd0065a02d4acb55f1545ffcb4f1eccf0
SHA256eae56534dead3aacec847140b248414fe32ab9b70ff5990197d52b80aadfd86e
SHA51269b9fea21bd3a36bd85441b9d6bf84b06cc0e1046b9ee648ba7079e964129708735a5c81a4bf27c3f304e02b706cf8c3c932fc6b23a5ea7753a208ec6edda191
-
Filesize
10.0MB
-
Filesize
2.1MB
-
Filesize
1.6MB
-
Filesize
488KB
-
Filesize
10.0MB