Analysis
-
max time kernel
143s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
11/12/2023, 13:45
General
-
Target
906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.exe
-
Size
6.9MB
-
MD5
18b06b0a59a88d323dd3ad553f411662
-
SHA1
916bdb984b117a4e28c858185cea889ae1d40b0f
-
SHA256
906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb
-
SHA512
946deecf2edde5995aaf6fde8d5e757f6b8fa73b52eecf404f1f6e0365ee64a505a1d77b72d1782d63cd468e74a76ae68771af924a34d7f5e402cb66cab989e1
-
SSDEEP
196608:+DoG3bFqjpLC0TSMLsn33HR83v9i8l7INzj:+DyNLCWZ2HS9iQ7INzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.exe"C:\Users\Admin\AppData\Local\Temp\906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ENKQP.tmp\906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.tmp"C:\Users\Admin\AppData\Local\Temp\is-ENKQP.tmp\906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.tmp" /SL5="$D0068,6971036,68096,C:\Users\Admin\AppData\Local\Temp\906ed1886de161352d7d940a1b63eadf810d8a44a8db677345da88e7b47da8bb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD51c9714516ca79a0fc5c3f877cc19819f
SHA1bc778972b7bf779319b6a93af152fe4398e41369
SHA2566c3d755fb5b42208ede447cf1fc03f56eecc096081c707f3acbc465facd875a3
SHA512ec210b22ac666124dd6f0fc10168832da540513a3889cbe0be627b941c31f7ed3568ca60e92d67767f2fe33f380666328ef39d164b2f6b9fadb3f8129ab010d6
-
Filesize
1014KB
MD5b6bc6f976491da5d64c0ad8294b24599
SHA17ad930847f97ad4fadadeac30b065160929aa88d
SHA256665c5eaeddb71d6bf24461d532eb774042b0b357928aef94445754b3ad099b8b
SHA512cb0a60958c38814869bf75b9aa1d24b456eb62a54c185123840e991fbc908b3c2eefc8bb602cfe68811d145874d9cb349dfbb5c1729ae81ec898276f5dce5800
-
Filesize
384KB
MD5c1a2a62e9911934595fb1ce578067819
SHA165eb42690afc1b4bae311684709263c80d142403
SHA25680320e3f1168f508d6deda848189f8de78d844e9ba3961d93dcf244a4e9c3b0c
SHA512497815d21fb6bf80c06a2d523e451ea4f813d7a9a04e8430b0c806263f35f46efb74ff8d5f9196c1175c39afc575699e0d9d9877097ed1ea59c5bf521f540e3c
-
Filesize
235KB
MD5e5a748da903bf27bc76794376e8c94f5
SHA1477a767ae6af623146ffb323882ad2522c792b14
SHA25696d18c8ff7951e5b98e5c51ce02309c1448c7628de423756139c39c9519453b6
SHA5126c607c9a49cabd4f322d9c25e7227eeb59774874d756f68fcca37277a56a4ea2778341a6547ed0a83a253b43730266855209deaf70105912da7a97a780080748
-
Filesize
301KB
MD5116475fb975c53da0f035515cefffba3
SHA10d80a74ced4ac81962820d3cbf8e67ff5365720d
SHA25601b5c83e31e3712becdcd096cdf95b63be15d83a67e7ab888b1f350d144f62b2
SHA512f9981d9d880f0113312432c20d21995b762f55dca16d7e9af6dfae9c6df18b018ec0c27e694e75c86d003762c9e2d81f20b24e2bbd80a103b166de4141f0125b
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB