cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8

Analysis

max time kernel
200s
max time network
227s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe
Size

14.6MB
MD5

6e260fd647a08f1c3cc8f8801cd092b4
SHA1

87d491fd373359d193b06d40a956311b39277b0a
SHA256

cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8
SHA512

82baf80687d86eba31aac36acf5fac73281b2d8830a7d318990c4cbeb4f33efd62bb90c3a7f602aa14a26f8bb09f5b9fea8d556e5514f89c370b55cb993fe16e
SSDEEP

393216:3VhgLN/qpGQLRetz6ruzaaNWz8Wjtq2HlOj//8XO+17nN6:3VhgR/tz6ruzaa4z8WtrHI8+w7s

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4836	cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe
4836	cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe
4836	cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe
4836	cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe

C:\Users\Admin\AppData\Local\Temp\cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe
"C:\Users\Admin\AppData\Local\Temp\cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cace4caef5fe43241161e865b004b14b4e3b37e8122345e38385b6519e59dce8.exepack.tmp

Filesize
2KB

MD5
4156ed8445cb964e4d3d10234396e4d7

SHA1
f8de86fc5eb1097164d8596f8d81f9f90c294097

SHA256
d2ce4c3b3e18f0e4c46098495ae5d693e655c5ed7eb170b4c75b2c471331cdce

SHA512
a5c2e913bda1b2aac5cd58c0b91cdc33cfd857abb7b4a636214fd325c80e46e43006ced5c18076d8ffeabd15dfc25073ab04e38cd1e074a9614b704e2142e4dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\e879471b9ab56b190dc4e2b4dd738f83.ini

Filesize
1KB

MD5
4fe3a339d7a8b191af53bec900ae1841

SHA1
e65ceed8e70da862e4acfc4e1d5571997f0fb5d9

SHA256
82a06143648465d734c6ae1752a468131d239c271ce55d43fe021fca98ab6800

SHA512
dd5e1abfd1c83d735288c2062c25d189b4d334220265c2c1020e3505f45a6ff884d2f0aa2bb0f6b6feaea669f8bd54b6aa2aba57ab949f0d2e65144616b8a991

Download Submit
C:\Users\Admin\AppData\Local\Temp\e879471b9ab56b190dc4e2b4dd738f83A.ini

Filesize
1KB

MD5
a971b06a6ee40fef3bb35802ab6a392b

SHA1
ec53957c415c8fc644a3c8b98f4a0d9eb2010148

SHA256
f5655344644b192dd6823db1482b2f31df4e3d11d815ae9b8302d6d55b6ac34d

SHA512
4cd5a79681829064fdade4b6c3f77a27bf58b3fdf52575bdcec64ad892e4151de96cbbec3c2ee1de9e12b5ff35a53fead25786916be8a81c6fe2ebb15a5cc1b2

Download Submit
memory/4836-6-0x0000000001F10000-0x0000000001F13000-memory.dmp

Filesize
12KB

Download
memory/4836-5-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-7-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-8-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-9-0x0000000050000000-0x0000000050109000-memory.dmp

Filesize
1.0MB

Download
memory/4836-10-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-11-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-0-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-2-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-1-0x0000000001F10000-0x0000000001F13000-memory.dmp

Filesize
12KB

Download
memory/4836-344-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-345-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-346-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download
memory/4836-353-0x0000000000400000-0x0000000001DA1000-memory.dmp

Filesize
25.6MB

Download