Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
22-11-2023 05:24
General
-
Target
6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe
-
Size
3.8MB
-
MD5
9b7ba61a8161f042f18e4f0ab561093f
-
SHA1
6664f1697e78e75db5f26840ce2eb1667ce14b70
-
SHA256
6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562
-
SHA512
753f2d4dbc36aa246a33cc90e49e85030308c866cd145ce76824bd463e0606d11902c1ba42d5b13b3d77b7ffee489675157d1c799663cb2dd2a58dbef64c096c
-
SSDEEP
98304:Di8f4s4itYO1d9iAa37INDDhlElcVF/t5X:DiPDiR1uVIkSPX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe"C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe"C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe" -gpipe \\.\pipe\PCommand97Getscreen.me -gui2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe"C:\Users\Admin\AppData\Local\Temp\6bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562.exe" -cpipe \\.\pipe\PCommand96Getscreen.me -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\leuxltwwasseyoqusvuvlwhjwpaexxn-elevate.exe"C:\ProgramData\Getscreen.me\leuxltwwasseyoqusvuvlwhjwpaexxn-elevate.exe" -elevate \\.\pipe\elevateGS512leuxltwwasseyoqusvuvlwhjwpaexxn1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD59b7ba61a8161f042f18e4f0ab561093f
SHA16664f1697e78e75db5f26840ce2eb1667ce14b70
SHA2566bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562
SHA512753f2d4dbc36aa246a33cc90e49e85030308c866cd145ce76824bd463e0606d11902c1ba42d5b13b3d77b7ffee489675157d1c799663cb2dd2a58dbef64c096c
-
Filesize
3.8MB
MD59b7ba61a8161f042f18e4f0ab561093f
SHA16664f1697e78e75db5f26840ce2eb1667ce14b70
SHA2566bb104271472d489b6901261d2d573f6b34c9539d93cb9777e486f8d41e3e562
SHA512753f2d4dbc36aa246a33cc90e49e85030308c866cd145ce76824bd463e0606d11902c1ba42d5b13b3d77b7ffee489675157d1c799663cb2dd2a58dbef64c096c
-
Filesize
673B
MD5a773e4bcdfedeb22c29a55f6fd26b24c
SHA11fc69d0c4cbf2c7ae9ba04970a53e13a58e75a27
SHA256c9edbb4a31e311505577d2cc255414d8c762524e3184221165e0518e00241245
SHA512793e64c7ae2e526d792e2a4df1005da7b374e0a23287a6f395d06b384c672e0cfb4676f757e3f80461f681d79741a8f4252a1d6328c3e8d36ab19311f3096a0b
-
Filesize
2KB
MD524c210637f511aa6343da7de23d2d71e
SHA1c8b776e4513e9e6cec50f3c886def0c177f29d12
SHA256d0795cc73a2bc90f4725be9b4da686d32be3667d383422bdd5337a37a9c631d0
SHA5123230776c2adb8aa4bd4f6bad476264561eadb7fe90da94bde2964d58cca109a2d2b79269689aca843408fae09bb1185e21e68046c6f28b0d577d58a94f0adb55
-
Filesize
261B
MD5b6593682325ad2315228ecbcadb813f5
SHA1570ef124e452d720282c79105110d67fd1f14514
SHA25671923c666a4ef4f2aa4eefee89f314d8707155adcc76eada34f16d115f4e95c5
SHA512291679a2aa388e6422759809082cb13e7307e5344cbcdfdbfe1aaf96656f871676fef0b7ab03dafc22b93d114a40f3bf0f49ac54f368a99d165d8b42259e63af
-
Filesize
16.0MB
MD54b1b4e345cc5f2c368f3ac861ef9cf78
SHA159a6c0a73cb6e95ab5ff8575cb5777ee7945dd0c
SHA256ae8286341fde8f581c76ee67718d602efcc5d94de663d2054f9dca1a6195e987
SHA5122dd27dc84c14f7d88bee7494900a68149d6d7de1db768d92e6fc69263646f0e7a22dddb36aadb35d4176fa284b16d293356a0403e87b758e13b859a6368edc0d
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB