Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11-12-2023 10:03
General
-
Target
6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.exe
-
Size
6.9MB
-
MD5
ddb059fb04c4b2986a3cf7c9454b7ebb
-
SHA1
a841e1fa4d3e2342b7f9f68735665a232903d6ca
-
SHA256
6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101
-
SHA512
9954d676d4166e361ba4e168c222116b6aabef396dde9090459eccb5e62a618540cccd1632c498f55afdd93a1ac47758ab4cc2a8b8ae9ffb262a8ffa00a7c890
-
SSDEEP
196608:oH/2cOhoGEpX+jRFRvz29jgM7+3Utny3r/mvZO0agzj:dcOhoGE1ArRvqlgM7xtAT0Hzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.exe"C:\Users\Admin\AppData\Local\Temp\6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8PRF9.tmp\6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.tmp"C:\Users\Admin\AppData\Local\Temp\is-8PRF9.tmp\6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.tmp" /SL5="$5021E,6982471,68096,C:\Users\Admin\AppData\Local\Temp\6428c88a63b7963e9c3209327f1a9b1c9a39caeb6e89ae5c9aff4a64cbc08101.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5f525b82e76f81c5cfaef5e1330acf635
SHA1eda941e6a8f47ed637e466e818bd2098fb22930b
SHA2561b972f66f4eeb17b15e5f00fc159bacfbe83fb5a0fef33c1ecc7322aaaddf80b
SHA512ee3734f5e9d60b1c965608bc31d05d2fda601e3ee41549e2029aec0a2abd963e3755b1085309c827fc48ab3fbe70a7d59e8367b07f39fe4ecd6d0f9ded28f56c
-
Filesize
184KB
MD540a6fc925b6495742fba4dccaf0d23c1
SHA1024927f2aac9a04522e0317db9560bcf1d5f9676
SHA256734c33346c4b6f3154b7ee1368f55ff97bf945662b718852d2145a1afb211328
SHA51271d996cd601a4c06d028ef2c46824ab75284ee2ef1526e7105113e26afe8789081475de8b4a951fd5564517a3971c04a35faf1891b47c1aaa16155d5e21ae066
-
Filesize
74KB
MD5ec6a2d18b1e09193cb1c1e951630f256
SHA1b9138c32ca6a04286a44cfbfeb131cf26292c12f
SHA25667ac9e087d9903738e1b531657530e11cb835104ab00ea30fc050f245458defc
SHA5128e23ab24461f07b4635939dd70934fd36401dc942ad182a3b30f69aa83c46dca5d6610cb92090e8cee2f7e0bfab55409135bd230054085b4babb1f35f45ec2ef
-
Filesize
183KB
MD569f6eb2bf9a459757dc31bf76060ddea
SHA121a8e5f4af34afd6c53f9b0113dd3a1e621724a4
SHA256b444f2bcaa4b18c20c90ebeb604b548741963a6095f53fa65bab3ae516edfb0e
SHA512a56ada43b707b70dab9fa7cbda80de3fbbf9fa92a8345c8e96d98cbb0962ca977c1bd65d805a491919629df3bb766dd6a350cd309c37908c2192309652418180
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB