Analysis
-
max time kernel
103s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12/10/2023, 03:11
General
-
Target
4a082ffffab7e35b335d9033ee17a4bc13090deda22e6a7aaaad2f1d9cb91847.exe
-
Size
13.8MB
-
MD5
f6b56a268b09d387d067fabb8dfaf6fc
-
SHA1
cdc2ac948df0ef313331123b5e60c9ca43cb7de5
-
SHA256
4a082ffffab7e35b335d9033ee17a4bc13090deda22e6a7aaaad2f1d9cb91847
-
SHA512
b08c6eecc97f6ff9b936c01ad66f368b58885e9ab0c03cb718081957beb182977278c2424e5b24fac8e398c4480ee707c30d7ff451690b1d27eadb9e1a7dad3f
-
SSDEEP
393216:0632A626oV5Xa0Ahf9unk3rVUz96uKrbSwO7kpBEo6FT:082A62Tf1Qf9fbVUp6DbM786FT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 10 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a082ffffab7e35b335d9033ee17a4bc13090deda22e6a7aaaad2f1d9cb91847.exe"C:\Users\Admin\AppData\Local\Temp\4a082ffffab7e35b335d9033ee17a4bc13090deda22e6a7aaaad2f1d9cb91847.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ÌìÏ»ðÁú[kcq188].exeC:\Users\Admin\AppData\Local\Temp\ÌìÏ»ðÁú[kcq188].exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\\*»ðÁú[kcq188].exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\\*.dll"3⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 11723⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4076 -s 11723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4076 -ip 40761⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD504451f7a85284b2da1f801fefdf0c675
SHA1a84da8daad8c91e1df11d88ba5144659d9c9ae95
SHA2569b940b3a455c28d9ec2bf39ff8655ef5d81c1807bd04bbcae8ece1872466ad25
SHA51276019f8aa944f6ebac5f54ac24592cc1ba044b877634b433f18d2bff655668fe3cc5b707bbb180e4097a99bcb3bf08437197955092581c3ce4e64463dbaca079
-
Filesize
1KB
MD5fa11c7db164330c4e849523bdaad9d48
SHA176785e2c93b861a672fa7a1fc213a14b5496ca50
SHA256d01eda608874c6cff19ce8af6f7b400c6e62f1594d220d99d3155e9072aebc71
SHA512c74172c56ecdd999863f2321b8a5f74f8e2e05a153949b3d3424e5249fd81ea8ec5a728646d152913fd1217f31790f013fa1088b69d7206e810a6ef90bc94fa1
-
Filesize
11.4MB
MD523cdbe510eb81f0f3e51d9b5dcad268e
SHA176f6e171849b4ecec9f8bdc21132cadf96c163b1
SHA256e2638ff247fa71267874c037e13acd92dd18d83268d7ca743122285c4c0ffd43
SHA51219488439dd0a94984b6b8883df797ba4dfa45f2fcf20d3cf516f0bc6ad7d7e8034b446d2d6e7d0da139da9ddddfc2f1fce83a261678de42e01a27330ac9e6500
-
Filesize
11.4MB
MD523cdbe510eb81f0f3e51d9b5dcad268e
SHA176f6e171849b4ecec9f8bdc21132cadf96c163b1
SHA256e2638ff247fa71267874c037e13acd92dd18d83268d7ca743122285c4c0ffd43
SHA51219488439dd0a94984b6b8883df797ba4dfa45f2fcf20d3cf516f0bc6ad7d7e8034b446d2d6e7d0da139da9ddddfc2f1fce83a261678de42e01a27330ac9e6500
-
Filesize
2KB
MD5948220c22b974fd415fc1127c2cf4d25
SHA19e67cba237fcb55f89adb2a5036f6b894e920277
SHA25656d84fcea1e1f285dfb857d9c1224b27adf788221b1a134dc78fe5306c7056e4
SHA512d6d901d6f5594698362bb9331a308494d60043a500026bb9f0e25069303001d3d47987de890ef5e6d52babcbb5143f2434984ab482b9d878ad40abb9d426e87d
-
Filesize
2KB
MD50d3644f92b5e997472475abf09e246ad
SHA117f65ad11d63bc1d6305364c48bd50db70fc7e1f
SHA25602be8e26485ad0db3cc108ff050282bff0cc43b35ebb52feb82fa83006fc7925
SHA512fbf60416da6e64f65f82a0d0e6523cc9d3abfc9b1880413a919f409be5ac7794be60557203047cee2dc871b517ff5d4f1a73573e3c6e9fb7b30f72e1cf7c2c1c
-
Filesize
2KB
MD57e3e9d2f8a31856202bc0e5917261d81
SHA1b167609f26f7c3890f10fc05c3a020eb52a0dbb0
SHA256169eff3f5cb27737bde2139f286127fc2fdc8c053968cf78783682f07c1a1a51
SHA512fa06ffa5f4a41ecce273983135e9e080cf0f4b79860d47d56de296c4611cc3e6ffd7c35904c8744f6212337ecf321df28a54960730b2dfb8cdaa81091250c1ce
-
Filesize
2KB
MD57e3e9d2f8a31856202bc0e5917261d81
SHA1b167609f26f7c3890f10fc05c3a020eb52a0dbb0
SHA256169eff3f5cb27737bde2139f286127fc2fdc8c053968cf78783682f07c1a1a51
SHA512fa06ffa5f4a41ecce273983135e9e080cf0f4b79860d47d56de296c4611cc3e6ffd7c35904c8744f6212337ecf321df28a54960730b2dfb8cdaa81091250c1ce
-
Filesize
2KB
MD5fdcac293537dfdcc9c15dfa0edf3a037
SHA16d86f85e83c953931be2f872643ce2aa2a944662
SHA256bd9aa6e56971e01ba1d2b8f1f067e555bce1587be99f9951ad0f2aa2a70ab007
SHA51298fa2105db9922b0918e6d98fc9ef3377fcb4bbf07a6db0f18d2c743c70c9d0985e58d8cd02964119dae3cc51e1f0798277a9f92b548316bf6107f7397a8538c
-
Filesize
2KB
MD57e3e9d2f8a31856202bc0e5917261d81
SHA1b167609f26f7c3890f10fc05c3a020eb52a0dbb0
SHA256169eff3f5cb27737bde2139f286127fc2fdc8c053968cf78783682f07c1a1a51
SHA512fa06ffa5f4a41ecce273983135e9e080cf0f4b79860d47d56de296c4611cc3e6ffd7c35904c8744f6212337ecf321df28a54960730b2dfb8cdaa81091250c1ce
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
17.3MB
-
Filesize
26.9MB
-
Filesize
26.9MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
26.9MB
-
Filesize
1.0MB
-
Filesize
26.9MB
-
Filesize
26.9MB
-
Filesize
26.9MB
-
Filesize
26.9MB