Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
30/10/2023, 06:30
General
-
Target
a973c4d0fc1dcbae8cd7084d4a2d506927a3a78cc1a8ff0bfb8543e184de2101.exe
-
Size
6.3MB
-
MD5
c36cf82ca015ba10374c92e7a05ad09b
-
SHA1
486fa5709521742297153ce195a379d786d8b54a
-
SHA256
a973c4d0fc1dcbae8cd7084d4a2d506927a3a78cc1a8ff0bfb8543e184de2101
-
SHA512
7da1c7d12c64ab695a0268e1cd9b1fde86bd8ef76e74f9d44c717f8d0f2c6e5dacab9bc88bc07098d3c2666825d6f51d3e51d5425c8daa53ad12838a3cc0d8e5
-
SSDEEP
49152:sHAL0rqy4fB7tBisZHoOb3TFZPdBA+MIRGK517Kp0DQ9ZzFnQBptZnNs4T3Bet2y:3J1I4fBJHRf5EWD48B/1x1qbBCX7Dc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a973c4d0fc1dcbae8cd7084d4a2d506927a3a78cc1a8ff0bfb8543e184de2101.exe"C:\Users\Admin\AppData\Local\Temp\a973c4d0fc1dcbae8cd7084d4a2d506927a3a78cc1a8ff0bfb8543e184de2101.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Downloads\ZHifYdi3\eFbkWJG5.exe"C:\Users\Public\Downloads\ZHifYdi3\eFbkWJG5.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo.>c:\xxxx.ini3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
350B
MD55babc7d734d6a6fc22c78328ad93197c
SHA17e02401c9ca1461bc8d8ab8eb478eed3ffcdf36e
SHA25683b385e592b2881449356f497fb3ed58698e9707fa42d980292a959641a2254c
SHA512523ba789366e81e6ad0cf9ad5cdec1c1d00d4302f9f2c6347bb75d006d6d3bdccbb45c6e8aca95b2283eb9b5236d88924565b9b03a56af5eae131f3273c08d70
-
Filesize
6KB
MD5e39405e85e09f64ccde0f59392317dd3
SHA19c76db4b3d8c7972e7995ecfb1e3c47ee94fd14b
SHA256cfd9677e1c0e10b1507f520c4ecd40f68db78154c0d4e6563403d540f3bf829f
SHA5126733f330145b48d23c023c664090f4f240e9bbeb8368b486c8ee8682ec6a930b73275e24075648d1aa7e01db1ec7b7e259286917a006ba9af8fb7cba3439070a
-
Filesize
36KB
MD5f6bf82a293b69aa5b47d4e2de305d45a
SHA14948716616d4bbe68be2b4c5bf95350402d3f96f
SHA2566a9368cdd7b3ff9b590e206c3536569bc45c338966d0059784959f73fe6281e0
SHA512edf0f3ee60a620cf886184c1014f38d0505aac9e3703d61d7074cfb27d6922f80e570d1a3891593606a09f1296a88c8770445761c11c390a99a5341ee56478aa
-
Filesize
358KB
MD57e935603d4e2018ade112538255db3ab
SHA1e6df27d495f53dc93374c0bc1eb1cb7d0599e442
SHA256663fb53fba961773cd58ccd903d476a690d5207fc4e7d069a6418671981ecf4e
SHA51299a00d7688ba9eabb31cca967c2f0b581bb7971d59ca96a3eb6a041372da27281267b7dc84d3d936f65b0e2247aa253ebd4c413afc5a95cfab6f37ff8365d331
-
Filesize
132KB
MD595a6dd529a4c2929e304b6fb6f898e5b
SHA1b988d01c3176fb61f4ea9159e52d82916efc4295
SHA2567b13204e0cbd82b9f2a5f63dd1c61d7d7f75415f38eed87f4b1b5231a882561f
SHA512db5ef3015e404a8b4b9c06c3c51087bb82e2581ee025713a0bbf18de46bd0a0a30e29fc0cb470ceaa077645bd4daef44f6a6dc656f6da524a335b3ed03fb57b2
-
Filesize
529KB
MD549d595ab380b7c7a4cd6916eeb4dfe6f
SHA1b84649fce92cc0e7a4d25599cc15ffaf312edc0b
SHA256207d856a56e97f2fdab243742f0cfcd1ba8b5814dc65b3798e54d022ce719661
SHA512d00ed0d9baae96ccbaf1262b4a4aaf4468e4ace6cebcea81e74d830bf414d9bc61068b8fb0eefa742add14aec47284f3adc11be26c8b8d66bfae4c498f2a4110
-
Filesize
53KB
MD5fc8d1e583c97fdbee707332c651b2074
SHA137c586f0c5cd93adc67dc61856b33f03f97938d0
SHA256c3144acb3d474c739a64806de52b7514f945784563af9ee395e2c104f7964c3f
SHA51246699d0de5e10587250f3fad3454edb4efc92167c026aa19d064d7c002c8a4bd0363013aabba9c467d05e7bfd42dfaa489f72b937d0eaeacaf3aff1a9eab3be4
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
388KB
-
Filesize
1.3MB
