Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
11/12/2023, 19:36
General
-
Target
021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.exe
-
Size
7.5MB
-
MD5
cf50fca11d2998e2e43660258767898a
-
SHA1
802aae8700f10686d57ed2652600624583d5e9de
-
SHA256
021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33
-
SHA512
7bf888e72ddfefc1257391992c2e7dc63d3ef48544d27dcf1c4320108fc73b8a5cb85a0d0baebd734296d0fb50829fe91213b989a381a39b4cbc0c704c02be12
-
SSDEEP
196608:RO78pimeIjZMmsj7bXzjl3iT1A9SG7ul2xdVNWiYmJE6RI6zj:U78pimNjMDzjl3dQAdVN1YyRPzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.exe"C:\Users\Admin\AppData\Local\Temp\021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8HPFS.tmp\021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.tmp"C:\Users\Admin\AppData\Local\Temp\is-8HPFS.tmp\021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.tmp" /SL5="$7011E,7611198,68096,C:\Users\Admin\AppData\Local\Temp\021a02e2fa9b0fc50b31ef158137db53070061ac4b9ad20c473761e91a2bfe33.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 111⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5678a17d96eb8a3e7a24654484259ba81
SHA134bb657495987ab036475c58354d9ecc811e1405
SHA256e54c14457557630b358c7d0d0467fe52fe3f93e788de589a14c24a44b69b262b
SHA512809195467b141dda066b61706b3f10c84530ae2c0c6b8fc0d9716b39f41f1d29b181188cf31712c562097d4219c71fa05bc3f513c88d17fd1514a6eebf02baa7
-
Filesize
200KB
MD5acf77825240705c936c04f144f6ed7a6
SHA112543f9806ace5f619792428afcf5b35ff56f2ce
SHA2569a64bdcd131af58c3125dd979c908f2bfa262de244b0e9b927b62fa51e074cf4
SHA5129ab388eca00d5f73621c277a8c3a2d2c3fe110333d6ff12dcb3f61f48ef589b0d99794118b16c1b1a7384168141c525a8fadebd61e6dcbfa09ee0d76cb10f5e2
-
Filesize
76KB
MD544164502ba3984d3c01230c9f25a8bc0
SHA16d5761c58dbd179cba0eb09a4b09b6dd560a4667
SHA2563207170cb4e6fd8e5af7c45b334e276a924ad2dd249dc180461c5aa92fea2e0b
SHA5124a234bbc6f85fece03ee6bab8dc06f932568c7d9490e450a7918aff06695e4443b1a62ccb8bfac0da1285dc5c7bb83b480d4f4fd9deac42b9dae98f02b7e5873
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
6KB
MD54cfcac5c896ef8e51763a24dabd0b7f0
SHA193a7f00de4c569b38a4ec8d0b1fee4bb91fefaa1
SHA256786de10976ff05546f022f39daa68f273508fcb6e5ef2e8fc3adc958cbf2e57b
SHA512070918864a0d21c269b86afb21bc66ecc5d599895eaed332c04bc016371be70a8d2552cc9dd0ba8b5ca6204ddc11dd68c3281458da8266dbc7ddae3c5adf70a7
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
133KB
MD5abd312500b5beb1dc87a6aa1a8ae3161
SHA1735f1688bea98649c4a26f4a59599fabc9d89b3d
SHA256079a7b4bcc7dd8b270a725ad93c1cce22c46242a2b2a97f5b44fe17c69507b70
SHA5125d02e55b7cfe4239bf747ec722fdb9c6d61b3a185d1beb76fc6434dba0d93ff9bca2a9af062696cf8ff74da5dd2664f9bd8669af08268d2e25ec8bca0f90d061
-
Filesize
31KB
MD5c3ea739663f34ed2e6e6bfce590b9b97
SHA12d2c40bd144f358c3622ce7092c0053317275eaa
SHA25627bfb1696d48f729ed509c300b5ef68fdf17fbb4e928d5bf6dcdc6570366e5c2
SHA51203b23107171f6eb67e0d116c1db3ae1d759641a946011eb20709dfd451682cfb0277560345f9568f1056b2ae1adca091d78d5b0bbbdc1f58029c5de23e0e76b8
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
752KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
632KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB