Analysis
-
max time kernel
0s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 21:31
General
-
Target
3d93d3286dc09f2b25682cc346d01189.exe
-
Size
512KB
-
MD5
3d93d3286dc09f2b25682cc346d01189
-
SHA1
1df0f828c1be290b2024f9ecb6dd3a1f50504dad
-
SHA256
e423e3de4edc5a8d68f49dbe54df44a7c32d255ebdc23b775f9225b31e2ba93a
-
SHA512
782edac286467c6b62012d35258e3041d11b40bb44c0eec0cef0813449275259416635aa75b573eca96d9696d434e7e03869b786d19df2acc614f174e14be008
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6/:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5U
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of FindShellTrayWindow 15 IoCs
-
Suspicious use of SendNotifyMessage 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d93d3286dc09f2b25682cc346d01189.exe"C:\Users\Admin\AppData\Local\Temp\3d93d3286dc09f2b25682cc346d01189.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\bspbfooxcdguw.exebspbfooxcdguw.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\iulkjtuj.exeiulkjtuj.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\lycwpltwekgejcw.exelycwpltwekgejcw.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\dogoykkryx.exedogoykkryx.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\iulkjtuj.exeC:\Windows\system32\iulkjtuj.exe3⤵
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD565098ff201f24e0f4bb48117822294eb
SHA12f64ca612e0068be275505c34f10b92aa6f672fe
SHA2564e511be759dba158615780cf098294040627c4d6e351bb45433c8585f6306bc7
SHA512762713927d4ed192cd3a5bdcf422a1a1904f4d889d9a03ff7b8a45da3582963b4a8faffeef338ffe766a8a1065b7dc681162c76bf69eb3c95b8c0779874a92f7
-
Filesize
57KB
MD577044d3952f88caf4d27adc8137b673c
SHA1b04b129a45f3309c65ac1c20e301c14d842c1e97
SHA2563846440e5216e61339cb3f377d7a9c20d62a34edf73b54df57686ffdcb4485db
SHA5129745d11226149685c50c843ece588bdf48a062f07b566839ebe0de2caba3dd9d771edf02c2d07dd6fe6895ca7f231b847613357a1fb4a770bb802cce19b9e470
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD5f5891c5a3765bca16b9b162df987d146
SHA14090c6f99c02febeeb8f27c01351f2d95c5dea51
SHA256b8eaa379cbe02b99476f617f6a0e725af1d585a8c9210bd3f99c2fdf9fd021f1
SHA5124657a79cea8ccfecdfebbb6b140866d0204b2f55d149afcdab1f87e964d8db7265cce0fc7f9e6979c7cc60b4c053f9740d521f63ee565f818c20490c07a0ce92
-
Filesize
3KB
MD51c25c14562cd1bdb3dbcafad76fc3a14
SHA1b2cb709b55b991be166c001253ad01f6beadf8fd
SHA25652e46565038623f50f7a68f18e7d6bc0d40c50b95378f4968db6020c538a6115
SHA51262fcac5ae3e2e45fe8f3139da45175abac2b11f5dfe9803579420738c9fe5f112b23d4754bf5590b3516040203fd80cb2c1d8bea945ad7bedc7f8a463fe94fc0
-
Filesize
88KB
MD5c9b0dc904213047da84a977591f15363
SHA1c1186d7dcf2b50caff1d1794abe63ce38793d2a2
SHA256c6c1d6773c62e058c8c99bb7af1b92e553c17371b4d30161bc563906566ad204
SHA512e2abde09e7c76cf8b403f416e1559592eec8008324ebdc3489b27ebc5d14f35a9dc99aa25197491978f77128c1472640aae4f5862a596461b8120ecbcbfb5c4b
-
Filesize
214KB
MD55c9af3a79d73e48a4ba406d70cb24cf5
SHA171d1f8dc6ec6783478c8e7606b159a55d7df8be4
SHA2566937cb07c982307f017729977336ad941257a25d09128bbdebf67e4a150757cf
SHA512a45e5b6bc98f50373e8fdeca73da30ce8bc840d99efae8c4668e539096457e0e88f0239dc06afbea9f8eb346bd436500362ac82643b6b6cebbb2aac572c4d185
-
Filesize
153KB
MD558b8906af2f52e72b8c0c2867b0ddd11
SHA15b9cbd367efc4129930d3f2e3f9f3e95d9407839
SHA2563809883b1d62585855131330b3701bc9055bef070d43d2da78fb8bc244970b8e
SHA5123b725f1decac3468c7cd7105c0413bb01f9c18023441dce386b1ebb85e36d9d4c12748c97316c0da0ce5d9b6d7f007e20b0d0d1033e0662bdb9393ba35346c1f
-
Filesize
131KB
MD5f8f72f1f8f20fd96f9b745f751fe0726
SHA10184812acd51b125820949f0cd10e076f7e1aaab
SHA256b2ec04bac0451568b38fbb91e8cb62e256ab2f944c935cb4380e62e26835140f
SHA512b6611b85f948cafc55c9e4254e1a7c339d7a2854ec8d61f1d01cbcb55429aca57e60d6665954835817d59379282f2c6df83d541f6f08f78e4ac32c96ba87c4ec
-
Filesize
101KB
MD58077917708badb1f1142062614214dee
SHA157288a730b0bbb949d1ea4694a7b330c3a61eaf8
SHA25604796bd1951910dce220cb978e9d6a6ac3a8d7acc20a0396cbaf1675f712182a
SHA5125c91c0e9c64ec24782fe916e1331423abbdb12fba8fde43ef781cc0fa32649ec0623cc368661a50ba8479929c61418b32c76cddd0cd6a469c6573c441a836e2a
-
Filesize
118KB
MD5fb9dc56adb21c8c4be883e7d3fb951cf
SHA1552e9f2aeffa6a96fab342a9ec1779c31d915332
SHA256f69c23633c5e5fe1bc2ef2f8e506a3c9789642aa0f9d44389034f28a382105c4
SHA5125c3c1e2e6d54263b4ae93527f1fc6aaed739c3b084d603f257b955d8c49c9007616fc93e40567dd75ac6a89d5eec8c7bdff08aa308c4866db1bc14bc1425866a
-
Filesize
6KB
MD583e531dae4a2162142772264f916b530
SHA1b00f15d963a8ee3b3b70c41629a45a35924dcbb5
SHA25651532faa296877e9670541d23b8f4ba1dac9b0c45f5961782863f95e0963cb9f
SHA512ab300e8bae4b3b4d535f970dd716e72df4d26316e383a3ce456018bcbc65010f492bb6c2bbab010ca6d32c4926feaccfa5b3fc1ba074c0458f56409203633712
-
Filesize
99KB
MD5c7675be7653c3cbcab9092a05c527624
SHA15343d405bcf5882f8cdd18b473b645eccec8e19d
SHA2560164913589c110d26183dd0720afb8296ca36379c78beb263f2d9fb33229bb66
SHA512ca447db9155d01170c3aafbb9253d078e5fbf9701c584ef623044902a7212924065d3ab152c719e88a92ccce961bcac1714b15aae0b6bb981a8b89a9e919f2f9
-
Filesize
143KB
MD591a1c8d86849c8043fc155888f2bca38
SHA1532c7fcb322dfd6c4adadb0c59f753c7e7ad3ee5
SHA256fe1d482003ad987eb41167d7fe8c9e5f82de53474803705b8d52cb44ad34b443
SHA51294455a9fc92fd8855c33f2bf158704ba863da611e8ccf8a5e2ea47b113d189a8b831e4729e32ae89933176607f1b649e6ed9abb9229ba262f9dbee2ddabfbb41
-
Filesize
276KB
MD54cc1f2a85c1c134b37f89fd719202c07
SHA11f638f3248861864c0fd5f8aff07fee7cc158363
SHA2564a18f44e1c19d8f555db9d7fb823abd5a18e56e34df94e25ab8303660cf7f1f9
SHA5129dd0959bece9a124ad75dab26b70c2e500b723ee3430f953e01748cf093ab0f051d5e58eefe61e7e5d3799b2d046cbf8bd180e2f55495efac989f1629ade2fc0
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
45KB
MD54bd14592b06ab8e87b7553874dd18c65
SHA1c4dcdc335064ed1e4dd65bcc03c1bd28cca7423d
SHA256bf6f3c331b925ee848d4c67f973c2030314bdb3be833fa790bf8a46436e5d53b
SHA51204ea80bd4f788a59bd91a39451b6d7b7896fb7bd056cada7f87f6821ea381c132f5357ad24f02265625502723dbb5b9243294937991e452d0274329b6b632c9c
-
Filesize
84KB
MD519bfdbcd25ac65dec828d3d1b2b63cb1
SHA1ff1edc2d0dda3d94accc2df9cd43a562bea29393
SHA2564a9c707b46eafdecb28be28660b0848c73c60d68dcebeac5de8a5e6881eda84f
SHA512b781fb69c474de891b1c5ee07569d648031b83acc6d73b9a33c0eced047b9fd06af816e16dd6495332cc0cb406024d4dad25d477a5a5e96591c4dbd6b477128d
-
Filesize
28KB
MD5981b8f94fdd21256007d515564f45eed
SHA1998a544feaa9bcec48ea4e22a5c376ff2115dc24
SHA256a68688f6e082c9417fe273fa0fe6f02eb7c21a08ed39504b6437b7357ce4704e
SHA51263daa1dd6f3b720afacbd7d4bf5156a96774d2c6370355b3ae7801a7beec27d3f1dc238da87a8b4c4e8cf1a6fca230a8ffa811b6f214971348ff54b8b8648b6f
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
600KB