Analysis
-
max time kernel
3s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 02:32
Static task
static1
Behavioral task
behavioral1
Sample
53745f92c92fa25185d37c1093968360.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
53745f92c92fa25185d37c1093968360.exe
Resource
win10v2004-20231215-en
General
-
Target
53745f92c92fa25185d37c1093968360.exe
-
Size
2.2MB
-
MD5
53745f92c92fa25185d37c1093968360
-
SHA1
28a7682119192de103b6ec18f523109251e33f61
-
SHA256
555628994979ebb5381854d7d51b8378d12905a5f99d8efaf07e93eb56720eea
-
SHA512
da33bfef625496b697850b42a8d516bccaadbea833570fcee117a595651b670ae60f3dbd758bc37a258db46739aa0c789e8b0e7a0b9370c68f66c7766a2bfd5a
-
SSDEEP
49152:YisAGUB6z+YmVa9Ehv9k2dPk2Vr/u0HM9vBiahGKwKPT6:mNUB6z+pVIWv9NdM2Vr2KMjFhP5T
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Users\Admin\AppData\Local\Temp\53745f92c92fa25185d37c1093968360.exe"C:\Users\Admin\AppData\Local\Temp\53745f92c92fa25185d37c1093968360.exe"1⤵PID:3664
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵PID:2200
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵PID:4228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵PID:4160
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵PID:2904
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8, 8.8.4.4, time.google.com2⤵PID:3092
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Mjhbgvlj.vbs"2⤵PID:3188
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Local\Adobe\FlashPlayer.exe'3⤵PID:5104
-
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:4824
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:3268
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:4900
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:4252
-
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵PID:4304
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5407b26d1da5b001355adbc2b21afbdb8
SHA1e598f4c32593b304ad147a5f26cffee3d5c49a96
SHA256737e959cb3a9844cc699801b4d50ef6d602e2d491c18085df6b7701a66f2ea26
SHA5123a0e94eb64d83ff7d9853178326ed845bd25bc47fc13ad502d5bc592794622304dbbc1f43c46cb473a6e29d816ff979ba51c21ce0b7a2f82477e27fe19c75bf0
-
Filesize
7KB
MD57d0d3b993fe39b1742a481c713083c42
SHA1dc94f0cf96eaf066580a5c18f56096cf2e3ce6fe
SHA256d73da6a444b203d8361f115a3f83ef306eeabc5e1ff5361fe45ce5fba7cdd9a0
SHA512ff5542867cbd3dc4eb076e69a958598348d020b87f21275d747c9669d105cf1ddb21c1a2036e9c0fbc36dadd8139a3df7d7e6f50c5f031d027662e2b2c9b226b
-
Filesize
53KB
MD5d4d8cef58818612769a698c291ca3b37
SHA154e0a6e0c08723157829cea009ec4fe30bea5c50
SHA25698fd693b92a71e24110ce7d018a117757ffdfe0e551a33c5fa5d8888a2d74fb0
SHA512f165b1dde8f251e95d137a466d9bb77240396e289d1b2f8f1e9a28a6470545df07d00da6449250a1a0d73364c9cb6c00fd6229a385585a734da1ac65ac7e57f6
-
Filesize
19KB
MD5f2883f703ced3f56ca1ca537f8b8788c
SHA1fde277697fc7a2aa38ea6eea4ec3235fc5c0d046
SHA256ee84f0a084d9f26f3e6f2e0c0737fffa2a25d2177f37e032388f25355db01769
SHA512f7beecd347ef21874e4779c802d8fe6bbb0ee43837ad9a21ec2d356d171daf204bbe98c7904d22c60007ba26d2d651d7814d41c7aa08eb2e8c56d76927cde3a9
-
Filesize
20KB
MD5d0ef24de0712fe9ffac46b806608e765
SHA15b58f8366e4c3a17b0414847465f3c1a04ccd406
SHA256159fad637dec8f45b3af8dab5d8c9cd9f4efa4e650fdc2719e29530fbaf15025
SHA512a15407626f2f2cea36cf13d6eeb019d1d29d5474b34e886a4280dd7c70a8461912cc2e44d28bbf8c0a504da676e48db7097285c3fc143e06d0229178e7d4f8da
-
Filesize
19KB
MD5d144cc0ecb29f2d10464525dcbea5776
SHA192cd74bfa544ceef59654e5136bea5e0985cdd8b
SHA25645a431c6097f17d9a44d8b6af51c98b638c52619e1d1b2cb1055b6f305e867eb
SHA5124b4693194750eb96f985bda7efe8443a5caec8377744d77f3fbe5e758da921af58fdc87f9b3c810ac2db0820f9f96c0fe2a6a861e175779ad8f043057b6f4685
-
Filesize
1KB
MD5f303be22d784e4b9400e6deba816af85
SHA10b88ceee78d58155aeb0c6a51c0971a5997a4aeb
SHA25629ca0be0b8f32d4c9d50aaaf1e49be5021a315bb301564c086a37ebbaf258550
SHA5126120ad51f3700d727b532531a2b77a5e9466b1884b3b6373b1a2bd51ccdfd3ee3eb9cf5d5856dacc3efeeeb693c383eebf9c80c668caf0c802cb6907e5a017f6
-
Filesize
5KB
MD57229040eccfd8f1116d9607ec5187304
SHA1bc7524a505d28bcfb4022fbd4cea58d3dee5051c
SHA256b3fcc50b990b2d3c0dd5c9a67aababc2a4c4de93d1fc350446f793e7553ac0a8
SHA5123fe8c6390b4c7f72a45e146b143acc848e2d688339aed07070d5e490fddd121e733068ffdb25ef8abe2107c2a5e0f3c98f2a637bf61c6ceb2cd3d607cdecb352
-
Filesize
5KB
MD5aa018d5018bd943d0d6388771182e95f
SHA1b2db26cdc0afc7581c835e2c694647fb35efaac1
SHA2568539044887ac66d952874ef8573e81861571738a1f5de3d0e92f808031a65be0
SHA51288771db9ea5851e722f04121b7a40dfcb2b21a1d8f63b7a9fddeef8f271c9b0eb9593a2b0e6243d197e32d3643096517f0c554a3d780f4e69b26057f1ab215c2
-
Filesize
15KB
MD52f40cacba91123fe1571f5801e0ddd5a
SHA17bfb103a3c921a3539704a749a313b6cd0e4f37b
SHA25634a9401463d9a6511fa5e80ad75925060057ba69687554391acbc187a4fccec7
SHA51230406d1b16a108c539adb39d965c924f7e667ec4b5ae70846bd66ce7d3f12b6068f1798f4eae5109f9ae946097b6435e08e370dd66c46f8b5a0dd081d3c568ba
-
Filesize
63KB
MD50d5df43af2916f47d00c1573797c1a13
SHA1230ab5559e806574d26b4c20847c368ed55483b0
SHA256c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc
SHA512f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2
-
Filesize
11KB
MD5b4905eccd59dbbf5bb298399d3d33c6f
SHA19f1ce9ebf7ef01012333a8a41749df57f4d8d85d
SHA25609cc409b5c6d0e70ba02df369ade7ef9bdbe91ac0803d92a15c576e328e0cf38
SHA512d8bc722e5418112d1d422a698a1c9719cd65a6362233bae63b58380c4aa62b4ad1d21133a9154c9be2f66b66faa920b077e87ba98f2f47898bf7b65511d4fdc0
-
Filesize
18KB
MD5b884e4b12725f74f47040c0e5c7097c5
SHA1da5182bb225a70ed5c6cd1b8b007db8cb870787a
SHA2561893fa8801af7a3fdd084672910a1cdccd5d5903a97e98f115b9d669bcc62ca8
SHA5121e31c7a9da452d0e1a438df0c657b7e5155050f36b3bf9a26f2fe1688e839b55921d3b882433ee4ef7cc9ae1cead34acbb312e913b7ed454a3e3f9e448180e26
-
Filesize
20KB
MD5f90cb5b557ff3637d56e03ddb64fca8d
SHA162b02bd468f34dcfdd5304d3fdd9a1f867d92dc1
SHA256ac4f495c01a9733fe286ed5cb37e8f85f06661ae6075e80fe53f1378c42966ae
SHA512368c0e7e1362a7d83e188b30703a84546812183210affe75bd3eef1bb8519f14ad93f148da81b2b80543e79767e55f73efb341a368a5a3754a86d001944b94d8
-
Filesize
145B
MD50e442b7c7f432b800d1aa3ac1bf9aeda
SHA14738a1f8c05564def091e6767b12c39a7d31fcfd
SHA2562025a2c9a96307a19cd7dabbc9561581e502b59b11d6b94de6baa74b654d78bd
SHA512c7dcadb84ebc5a8ee034d9b7287435e3f2d3b88f5d07d89abdfee84e6aacd7f1b0d0d6ba4a8cb362e5438b30c4c60da8dbb6e7586f3472e0ce6b682fc2ddaa37
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82