Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
12-12-2023 02:45
General
-
Target
f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.exe
-
Size
7.6MB
-
MD5
c641e8215faf4683356dd35edb2527ba
-
SHA1
17da4de36f22cda315702d092a79d97465318e9d
-
SHA256
f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40
-
SHA512
9a8b6d0bfad68525b0293ef25a27b756c5144b7c4001a6a28856e4bc2f00b1ee1bf289c7cac8329ccbf0d134b622c7bef3a8dc74d44416ebd619f828f1ccc7fd
-
SSDEEP
196608:6nnY8NWvGpWTTlm0OxwW+nFnfZsMUdFt30Dzj:6nnY8NELTIrxwlxQWDzj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 63 IoCs
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.exe"C:\Users\Admin\AppData\Local\Temp\f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-6SCHF.tmp\f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.tmp"C:\Users\Admin\AppData\Local\Temp\is-6SCHF.tmp\f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.tmp" /SL5="$9006C,7715663,68096,C:\Users\Admin\AppData\Local\Temp\f12c62886fe02acd9c4528c6c2169ff3f2ad785fe1a0d748dad603922d8cdf40.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 113⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 114⤵
-
-
-
C:\Program Files (x86)\PlayGIF\gifplayer.exe"C:\Program Files (x86)\PlayGIF\gifplayer.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD53460e630e56a589e9c7bcdb4a83419db
SHA1e431583f750a51cea5a323e2beafc6092f1e1a7b
SHA256f713b4220ffd0ea9cf653bb9aa029fe710c7fd4061c3be5bbbe7e09d82d319af
SHA5120597fef4438ce23ac83b839119df45db5c0c6a6d81556893b1b33dae739f65c7e47564febb624e3588e2b9cbbdb91082a79053acc88c913ff5b7d9a48b3643db
-
Filesize
1.4MB
MD56c14f89f24b83607e7183b9b44c10e4c
SHA1aeecc9333277587c76d723e57ca10aca0efab1f1
SHA2560121e702882a1f871eca3f6e439b4b0c77bcba130206274f8e38c2434fb95c2d
SHA512e3c7ca608feb7fe82850c65febe77dc89e7f5a5b8837d58ac554534b81f11c44b117bf566af0e537d29e148036efa446d6558bca544a2d5ea155745dbe574c2f
-
Filesize
1.5MB
MD50fdcdc16d6268b05c08f2cce1265a9e8
SHA142921374efd73e5b145bff03ebc888bb2dea9696
SHA25649f9092608af412466cf86002add4c0eba4a7f040e2871b286a130dbd2198339
SHA5120221f3b99dfdfb2aa6e56e3d2eeb1763bd525fa380665c832e3d56866f7c12a8b746ae96d2421678ea146580aba0af3c1f156f973f4f7d42b2574d273cdbd143
-
Filesize
323KB
MD53237e37a748b676da4c064645313887b
SHA148f58428bedcb51900e0f3d6c8a3fac70f1dc268
SHA256f9ce20bc6dae337e4d81892a2fc8dcf263748ee31851d09868d884018c50f84e
SHA512b92726db4173caef285394b08d14797992306b0388e83a1ffc1ac928608768cfad2bc2396968850cbe46968926d23673e09c18f20b875d9047d3aa2c58cb77ec
-
Filesize
506KB
MD53ec26ca8c394f2a1875301342f08b708
SHA1f32705886d6cbde599c4eb1924a8c5ee65fead8c
SHA256172d4cf940fe7dbe5780a9ae33bc21b586361a3e72982b663c804b658d8279d5
SHA512a6a24865dae3a4c4f0558005280635f261ab67e950b64b6c1c65a6392452c529a0a876bd9b5f38e3130b8823436949cffed33b5136ce381155e8b4beffdb7075
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
632KB
-
Filesize
2.6MB
-
Filesize
632KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
96KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB