Analysis
-
max time kernel
54s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231201-en -
resource tags
-
submitted
11/12/2023, 10:38
General
-
Target
44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.exe
-
Size
6.9MB
-
MD5
0cc4d8e564a7bcaf065fcc604a4845f4
-
SHA1
b2e2886fea24ad4dfff2418bcf19216f5fa372e3
-
SHA256
44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661
-
SHA512
ff63827b14dc7a5f65baa606bdb876b944261fcf9097b94c0523ea9b5efa6f47561708b25e7c643711375952bcd25024fac9d61cd2f4191ae82cd1cadce14c8b
-
SSDEEP
196608:TyD4UUAnfcrSuleVp+jatZRGrrC/sF5wvACzj:C4Uvfc2RGatZcXF5uzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.exe"C:\Users\Admin\AppData\Local\Temp\44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-4AP0N.tmp\44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.tmp"C:\Users\Admin\AppData\Local\Temp\is-4AP0N.tmp\44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.tmp" /SL5="$B0064,6986290,68096,C:\Users\Admin\AppData\Local\Temp\44b3640cf9cdcd04f87709a5f61b8da10f0f71f9d1a9b427ff6fe6aea0a5c661.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Program Files (x86)\WMAFormat\wmaformat.exe"C:\Program Files (x86)\WMAFormat\wmaformat.exe" -i3⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
179KB
MD5609957870335d5aada131a4026006373
SHA1bcfb84c1eceed67c084ce8c7210592216f67176d
SHA256bfe4040f6fe7a5828ecab73f14dba4bfa6bf9f54cfc8aa4dfbb500f685258e76
SHA512e1587a20d4de78a437914b2df75c1d447642aad47dbc9788ee605eed493051fcbf6cc7e3227de109040a487e939de961aacd100934cf05735de106f5c69a76e8
-
Filesize
205KB
MD52db08a08fb9604a2879e64f312238044
SHA1012c338f6b820d84f43cfd529658d5891cce81b7
SHA25640600a346d0ca61d53ddfb7790d6041fd629dcd2e78393c9a955a6da29b8a33c
SHA5125e1f4bf7e41f051f99ea23667bbe08571e2fe693713170a8411556e669c27b52ba7bee71a7eb97948bd65ef17a28c31a690c9ecc11f95f9b166a4cab86d4055f
-
Filesize
98KB
MD58e9a049329e506216236db759ad28828
SHA1e074b38bcaf5cf9e5b614f434f425f923c48eb34
SHA256bfd30ce0325233c1d4a6bccd5ea255deb658f1574ef34c901cd42883d50b0d98
SHA512e8ad4cde25cc078abb5f014fa670d997805e65a2d7f0011dfc4d6860a0980a7aa7bdc03696a3599a5087843b6b34b6517785b8a04540eb4f734c9edc8631ccc0
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
179KB
MD5e3a8528e91567b1a119a3686d7dc11a1
SHA18084ebf2af19760569fc5e108cf48686a68412b7
SHA25605f488d72950b9665eebce2c4a780c682d52c4216fe0740ef7f7e35c0c56083f
SHA512d475e2f26dc5e61b33dbb901a28261ed440d8877b16433a9a2f3ab03adb2433edfab8891c80d084732d152744ea5b6ec731ef9cfbb4273043c4445e98b162c1a
-
Filesize
244KB
MD5134630192b0c859c807e38cea292fe8d
SHA115aec66623dfb77ce79ecb2a8bd7e998bbcb7733
SHA2567a6a2b3f7f760addbaf2afff21790de3b210c43516996cd359b53d52bba7bd9e
SHA512a427662d3c713c428731c7787195127024e360562dd26bacbbe85ac2cfc0901f1c973bf256c1da154a96b37daff21339adc7993e57f4c556ef794c5da364d332
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB