Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
-
submitted
11-12-2023 14:20
General
-
Target
5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.exe
-
Size
6.9MB
-
MD5
83df5ace94573864255d238c6740e4e2
-
SHA1
2d6c0534ff140bd2dd03a9480f397cfdc360638a
-
SHA256
5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412
-
SHA512
071c6cc6418ca2a72bafc7c0e98b2284afbf1ac3526f9bc705744d4b4bd1edcfc5ff7cb34df17d1679943797d566b29955ada0da25e2ba3b7a53a54c07c0e44d
-
SSDEEP
196608:WW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:WtO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.exe"C:\Users\Admin\AppData\Local\Temp\5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IR704.tmp\5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.tmp"C:\Users\Admin\AppData\Local\Temp\is-IR704.tmp\5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.tmp" /SL5="$A0030,6973457,68096,C:\Users\Admin\AppData\Local\Temp\5a6452554ebff81d16aa9bb819787e5ba861532643dac98343eb50556e97c412.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
302KB
MD57eb5edfb88a6d9d5f2503abce71a03df
SHA1722c6ad26116482efb2191f03b049ebfb42db7b4
SHA256e0988b853d39a30f3a84ae25d689f082d975b35a2d959f725da48733f40882a6
SHA51225abe8ac92e3ba9d6a22f6638720a126caf69314fc9f228cd065d8714f9b329ca5c6ed516e6f653754bd09d90d0ad5d7900a7b4739a1575e9ef978a4e9543fb7
-
Filesize
248KB
MD5d054c4861a98ac1d0156bc46c6dcbd39
SHA13d69b01d27cc9bd4d3fc1f537e2acf4786363f68
SHA25653010e765595686064d595d1684f64095c7ba7b64b033435239f33eda81ad669
SHA512dec5cf46481da3cb8502e52ef280bbed0dc49ae4c37362ac5942bd875e65b1437e8d104659ccd35fb2a6de50161e14b6f440056dd4428040c1d3775cbcff68fc
-
Filesize
140KB
MD5519e0c6cc9781206dd4fc4d7518303f5
SHA1cf61221b08e1923c6cf195d648bba1fb3b4f25a4
SHA256b28b2634f42300b62261df49670a4b149d7b69859c3f972459aba9c823a0f505
SHA51291f6c89e156a24d4f71509f5ae61a0de369be1f9c2508829849a031a6010423c2de2f6a432c24503473af6d12bad88a5796bca07be19c0109e7d6279b141d82e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
320KB
MD57330a578a9395cceecc5ee52a81b28c1
SHA198110ed7cdc1a545cf6cf992c1eaace34f26f832
SHA256ab49029caf77d789ac9042c8e8a5a72a98d2007afd7d68e7d54442832a01db65
SHA51266ac62b4d6a41806c4e194732107987fe4edec6147e9dc2bcb454549bd4c08239f038011dcaa16eb27300ce7ca0f8762f2f4b271db939b7f73806383e9704d3e
-
Filesize
142KB
MD55df2ed5abb122c309b391cb0bbe81b48
SHA17d1b5bfe9abbce9b4e97036545d67fe9aa6d2d81
SHA256c071d90e28920a7852150d035c8aa30929764e0b020c236c6722df1f4b6d2c40
SHA51253d1a059ea12b77d02318033fc144032abf148f6fa9b06577a55c77df5e99286c158ae041d91e5f381798e4eff0f0b0225c80956a5231e57912b6fa145698c2c
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB