Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 13:03
General
-
Target
32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.exe
-
Size
6.9MB
-
MD5
89e6892460592968fa3a4c37a6ec19c7
-
SHA1
b7af4691e4ca6cc63f14e1fdffd86a6c15f978bc
-
SHA256
32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331
-
SHA512
9caae2741a15467cc0b69807393d800ea912f9dc7090e12301cc3e4fad4318e271766357cf9c6995bd815463891f0fe2032f78d56dbba8b5093385db8e226f82
-
SSDEEP
196608:2W0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:2tO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.exe"C:\Users\Admin\AppData\Local\Temp\32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8K2M2.tmp\32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.tmp"C:\Users\Admin\AppData\Local\Temp\is-8K2M2.tmp\32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.tmp" /SL5="$5022A,6973457,68096,C:\Users\Admin\AppData\Local\Temp\32cf702108bf1fc6dde600043671f598fe5df93998016eb6281af89fdf89a331.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD511da3b7ee6fb74c0a5161dc107d031ed
SHA1223f43c32840cab6a3aff5a5fe1ff353e4d88c8c
SHA2560b7d48e7b837878bd92c1917b0ddf8048c522fbd9773e9db3f1963c9f56300eb
SHA512b247719fbbffb5f5ed8d3bdb416fefc408291d3359b41590f0f2c7274cae4e75a8c98f9f40cbdc33828427b16a73277adf972965817b4c047e9458dc10f7d39e
-
Filesize
194KB
MD534970b3dbc24fa1bc62ed823a3381c7f
SHA1e2d569b37f6afb37475898f7e3148eade64402f0
SHA2568cf7c4d8712e60c60ea2982319cde24a419eb8c83881ef85a34aab1a109ff042
SHA512b2c02bbc5c1182152d5b72c18fd26cc5416c563eb7a738e13ef929adee880d98198094c7d6f52dce0b0e13b7a454b8a7991b0acc0e15dca06a4095097c9817bf
-
Filesize
87KB
MD5e72f8609433a7acdb487ae94f3c6b947
SHA1eefc7a3b5388d712942d28e541557d75b1343e93
SHA256ed9a011d5e269de3e4511faf52bde07551b79393e982bdd9aa6c4ec35f400bcc
SHA512f8f93ee83ea5771c1ca259dcdbaaddddfddf6700f1e1b7c0391cb37519f041e7e54f392d50de853a6dd62297663fbac7c0990b586e4b78add017a957e805a47d
-
Filesize
577KB
MD5956aef64dd5f431cf533b97be7fbcafc
SHA1de8bfd7047eda18ea1388fb7c18a2647d7e9d44f
SHA256558449fda256efefc083456215e73df0e1fe179bd81da0875e6f254cdec24b0e
SHA512f245a90d19a65a8db43b72d5d5b57e4f9a4bf70eab0e5ccbadbbed1ac71009731a0409af21e312237256c4f9b29282c5d1ef99cf02db576a9e059bbd81bae419
-
Filesize
419KB
MD5135d3482e8e272038df867e482c3f1f5
SHA1edc5e86179f0d07bf7fe0185504d397de6386202
SHA256aa40e9b003393c666870b978795aa06602f5e8b81e13f669792c31b9228d9d0e
SHA512ce7c09113079f968d71818ae16643499c0330173fc2cf50e7d3a29ead89a6ae35a3631d2ef30acd73e1577361880d14feb0c88ef3486a7457c85fe2e14405d7f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB