Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11/12/2023, 12:21
General
-
Target
a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.exe
-
Size
6.9MB
-
MD5
8cee3e75c7ec6f6bc1353c4065e5202a
-
SHA1
8f8f8afc884ecc78671bae7bed01040f2c0b592c
-
SHA256
a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676
-
SHA512
283b7562d52d3b8e21b07fcb4cee66986612c134d72eb9da236440168a8544cd6a0b173a203e0dc301e0d421d0e2947de0e5b8a833b2a4946fda3f666a5432c1
-
SSDEEP
196608:GxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:9jkHxfKTnJjzKkRtF9zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.exe"C:\Users\Admin\AppData\Local\Temp\a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-396S6.tmp\a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.tmp"C:\Users\Admin\AppData\Local\Temp\is-396S6.tmp\a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.tmp" /SL5="$A0066,6950053,68096,C:\Users\Admin\AppData\Local\Temp\a1e7157536218295c3c83c29670efee970b83339aec169ef52350aeb7e17b676.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5723b2a50fcd4531e157347d90e1f57c8
SHA153feb4c0e81213116968be5f9f0fda0e26914001
SHA256c48ede9a89db845d51ca3befae99b1196ba5db071db55f8f0c11fb188b5300bd
SHA5125ebe84dd2679ceda1b4ec5a8d20c80dc2455596140f612ee4c5fb7d776576e6b05a8bdcb898ebc4923777682aa4edd96da4f900ce9991c088a019acce6f2e832
-
Filesize
982KB
MD5019288df28c9dcfdc04530f563a206ee
SHA12cc7543db0f08f29df2466d7aa1e214b0f69a21e
SHA2560872430489dc231756276854457d187c18b55611f0aa64f3f576d88663db7e39
SHA51206b1d766036d94f4e6c10ed7e6f08c561acfd27bc680dea3dd64e3bbf36d62b7950322a2e665c56247706ee67e7bb674275e6e73e10ff29578bd4fd43e13f8ea
-
Filesize
526KB
MD5c37e87578d4c7a781bcedba0a3cfc047
SHA1379b8f1187a3a0c264aca408a8f49f40042a6cb8
SHA25685f3755faa3481237f485da1e7c85d03a52c3ea6588576eb98d2561d7d2f3605
SHA5125d01002f571dcfd6d3ea0cbf0fbe5b538c2079868c903299ab7ca68bc8319c7564d210e26e7b7ff591cd88bf6804114243ea142b6aed75e55ceaac215e0cf49b
-
Filesize
366KB
MD5564277cf5581da01953a0fee9801b828
SHA14ee548a08e1f403486ec622506fb86883657c8bd
SHA25615d34ca6294c037fffeb8adce81c38ac53fdf7f2c39c675b26806a6fac96c9fa
SHA51247b93b0f4498470c287907805466736d9a5c70c78b9519ef380cc0ab3702c6211fe9c73d499e06b5aacbade4496877455051ca5be1ef903a3e7af9300df95ea9
-
Filesize
407KB
MD5c9490f49b178e80f354b9867dc5c8aba
SHA1123655158e9d6df408fd89b92b6577686701bd4f
SHA256c604e9b452bf2628cbc1ed02928717bf92cff06f89391e35e1b5bd3db6939457
SHA51285d5d3510fd29a0613b10d6067d9065935326ec33f3360ccbc14a1349564603ee358d8e05f0e1c5a703bd2ce9e72f309cec7bce994d04ebb29ce2a5a16fff7a9
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB