Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 12:26
General
-
Target
cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe
-
Size
6.9MB
-
MD5
82e79a3551443cf5e201a7ebe9ee0a3e
-
SHA1
e7fb6563cf07ba276a34e3a97272bb9e77da3c58
-
SHA256
cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2
-
SHA512
7ea45b1b5224ca4cbd28d6cfe1d540364c3e1d56412512137d3c6a268533d83e4bc5836c14dcb6928489410ad0823f7ba8ea011d3a70b138bf313a2f3e6d4518
-
SSDEEP
196608:QxOlhkHxfDumIwWJfU1IzKkGjAqiuGIqOg9zj:TjkHxfKTnJjzKkRtF9zj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp"C:\Users\Admin\AppData\Local\Temp\is-NT5A7.tmp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.tmp" /SL5="$50212,6950053,68096,C:\Users\Admin\AppData\Local\Temp\cf1d34c6767e23bf078d01c87d1f1950c89af935d5ade2c18170209aebb33ee2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
564KB
MD595b6b8ccc5cc268cdaf543d7f54e1c68
SHA10d06391c8175ca1c7a892a9394b52c50876d5450
SHA256ca344e18ed8f3b4ee239df195b04c49d8578ade8676cab0564dfce9168137c9e
SHA51243c691916d8f5404ed08ee0daa7a1aca9afbe9a5d663fc056bf7c76fb9ee63b1d205db06784e3abb084e3fbc57a1a3afaff410885fb32d2c9caf401ecde119af
-
Filesize
560KB
MD5d4bb71fb20b1d88dde7aaaa34124f54c
SHA137868a26d5497b0c8d9ebedaebcc5e193824198f
SHA256e2593c3e318afbc89c571042d688909b80f96ed62eb51a94f59298d6381749bf
SHA512c29662ba7dba2b07836872f9cf051df93338bebc09e0275f84a7affe32a686529d02b318f28a18581384c0ec7c5fbf26602cea91b5f74593ac962f21c6e0a54a
-
Filesize
364KB
MD5012aa20413d3e47ba1b8c1d034e14f03
SHA1f8fdc1fa8e570d943f5d5002f62c850e7a957c58
SHA2569ed66bcceb0a96736e9465c56da3b7cdd21e3780a66889070fb326aa2e9c20c4
SHA51262d866cb49ea805960df426b57013c5a9273a28ea2a6a41b4cf929db037f43be355eaa95ae16300f8c376d5304645a7c72ade66114b89bbd05b252a0fe583af8
-
Filesize
95KB
MD5bb9dfdbcd3afabe543a56ba40bdccca0
SHA1290d7cccb02aa51a8fd90e11634efaa2b3ffdc1a
SHA2566c9df259fd54eb0d58af51e1b51ec92e92945668fb5145444042afaebb43dd0f
SHA51207d96c03836a78ae591668f3e33353dde30949d24c2d782d5a834f9ac7f5d74bcecbfe7e6b00e713a3499e002bf30c323a83ad430d8f203b3e74beabd8316a8a
-
Filesize
92KB
MD564c54913ec7cf33c42d3a466c9186e94
SHA1b1a80174afe63f050b81eb6050e0bf49b18dd1fb
SHA256340040f9fa8f9866233e5b9375d62a606b546b2b83bb4caea27126099c3938cc
SHA512c317cf5303a6c6d6a066ec1aed70e1ea83d5f55b669eda0c8d6bb5ea77e98c65223ae391abb0214df891f874a0a1229c8edf7463a17a31bf1524a9f521b3e095
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB