Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 01:38
General
-
Target
ec87276074083160eedb9004de7e4cb879d6662b9404eecc16c16f2a52ebc614.exe
-
Size
79KB
-
MD5
6f8769926269c69b3d27e4a7851d2763
-
SHA1
39d7839269a804b55dc3b68d947d8c1acb0cfd23
-
SHA256
ec87276074083160eedb9004de7e4cb879d6662b9404eecc16c16f2a52ebc614
-
SHA512
e771b47e9e2c20029df1467c6adf5eeb58ae3f2d0a4ddb43c17c2d231eb6477decbdb899199ee70c7d056b920967434fee038910f24caf84e53e8779acf1ec3b
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWO0p/:GhfxHNIreQm+Hi5p/
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec87276074083160eedb9004de7e4cb879d6662b9404eecc16c16f2a52ebc614.exe"C:\Users\Admin\AppData\Local\Temp\ec87276074083160eedb9004de7e4cb879d6662b9404eecc16c16f2a52ebc614.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD57dd8c7c3071f2a703015840c5c54a0f0
SHA14fca0c8c5b08f37d27c98253dc0a122e18e54a16
SHA2562cadfcd37259bb15a1a5b5d8b7c05f1383b50db7606200f4c30d1e190f60c84b
SHA512105b6ffb6181b5ec5bdcd715dbff0a2aa3d5a57a355f79dbeaadef59995d09e33c82b2dd52c0378fe7a8bdc0e76e128b44a7be2cc1c1d104586b80d29f1fb7b5
-
Filesize
81KB
MD5ac8052c80befc6d411a8dbeb87338256
SHA173b84d0ecfe250738c10bf3a3fbdac3d755ee6f6
SHA256d313a62169185d12976f1fe9403515d49fc5fa2e7560c37e6cf66b17f6934fbc
SHA512b36c6e6282e6718548e8ad33bd4a6f682996bc38998f76c89d87e5b5edb843c2a9eebb2a361cea1231e48edf23a839f5e8b33da15646520179aa84d6cebe8de8
-
Filesize
81KB
MD5ac8052c80befc6d411a8dbeb87338256
SHA173b84d0ecfe250738c10bf3a3fbdac3d755ee6f6
SHA256d313a62169185d12976f1fe9403515d49fc5fa2e7560c37e6cf66b17f6934fbc
SHA512b36c6e6282e6718548e8ad33bd4a6f682996bc38998f76c89d87e5b5edb843c2a9eebb2a361cea1231e48edf23a839f5e8b33da15646520179aa84d6cebe8de8
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB