Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20231129-en -
resource tags
-
submitted
11/12/2023, 14:23
General
-
Target
855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.exe
-
Size
6.9MB
-
MD5
f4a514298b87ec235c55423f473ef8de
-
SHA1
f5b08e170d76243cc6826e1c0cdcd5b00802b8f5
-
SHA256
855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa
-
SHA512
1f41dfb05022789c1c98b386585bc1d0b243afddae3e816f0c2d878240ff94ec61cc7d5445c5bc368f0877a6288b8a0034d2d37ace95cb397ac2fa925ee1b594
-
SSDEEP
196608:cW0fKLtr95HARqIrmVY8S50UL8Kj8yTwHvWY3Nzj:ctO/hAPmVNyEWeNzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.exe"C:\Users\Admin\AppData\Local\Temp\855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-BK83V.tmp\855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.tmp"C:\Users\Admin\AppData\Local\Temp\is-BK83V.tmp\855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.tmp" /SL5="$801FE,6973457,68096,C:\Users\Admin\AppData\Local\Temp\855a77935f0efd46f574c1d10a0c5452b12cfaaba3bb9410f58bf25b49323aaa.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\ConvertWMA\wmaconvert.exe"C:\Program Files (x86)\ConvertWMA\wmaconvert.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
MD556e44a0541c86627cbc463d3bebb8972
SHA1962329f87cdd5c96209626b99319a84838a1d694
SHA256a9b74cf53464585d936bd84b5b964b7a5568273c71fc5e671f7ead14777a51e0
SHA5129e99f26e5fbb28a65f74218ebde4fde3f9a4afce461a77dce8806391ede39c6190d132a294c0b0fff3b62f509c784b136638d33ec38642cdb64b0a906f3aeee2
-
Filesize
277KB
MD535790e267c2e32f03955975f358e72f6
SHA1299e08da0bb0b6261b33f8aa7314fe32f0c275c7
SHA256ec22646e0cf9c5dbe13c351fee2f2f864f6ad1098928b97a52cd1bb2e5bd2ec5
SHA5127c4e242520e835ceee85e5c07cc6e5facfcbc9845e7c929d3db4bcf5b801bfd6a6d31d829b4719389b9d4b7eb552692b5d44cc3a9feffafd97088bb1e64d48fc
-
Filesize
303KB
MD5374df55b21c6aa9a3b642b8cd695c0a5
SHA1df55e17428989af734511884a3801024dc5626cb
SHA25622d8595d10cd7897e0920ac144f4c274fb1262ad96b5412e457d9618e70e0ebc
SHA5127a5b7e0e27e26d9e437e00c76bbeef51aed39340c38cd1c82f7c8a26b124e7296b5796d9bf2a3e684d77729e5f02277eeb9dcc745a3398e0eac683eda587bcb2
-
Filesize
555KB
MD53e3c34fb363060337d7cd992084162d4
SHA1a9351b948f4bb0f08c95fb5194d3211fb806898a
SHA256a8018ecdc1d5c82e2c5cbc149bfaad69e6531e85c376c7431e29adcabf823b05
SHA512ba0f64cdfc2879e6e3b1e204d17f29327cf86f722afa6557433c0f0f007aaf2f834ef208febb909358c91d8ccaf87a1d4714b868e28454ed7c158c8b7972e80a
-
Filesize
687KB
MD5f448d7f4b76e5c9c3a4eaff16a8b9b73
SHA131808f1ffa84c954376975b7cdb0007e6b762488
SHA2567233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49
SHA512f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
632KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB