Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 00:00

General

  • Target

    1b5b2959570cded90de2026af45870f9.exe

  • Size

    24KB

  • MD5

    1b5b2959570cded90de2026af45870f9

  • SHA1

    c15a49e0ff515adb6ad7d80bd55192d29f682866

  • SHA256

    637187013f30d12855bae6f3e4c33824a06485ec75f3d452c733895b28ca9d77

  • SHA512

    0a1eb247e47f2d1c1f5bd9596875a980c85812057c69408a8e3ec4f2e29fa6133ba498117aff2d0deaa3fc9c9bcb0897368e320f8d01fa29797bed75e65108b5

  • SSDEEP

    384:E3eVES+/xwGkRKJL1lM61qmTTMVF9/q5IjN0:bGS+ZfbJBO8qYoAIW

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b5b2959570cded90de2026af45870f9.exe
    "C:\Users\Admin\AppData\Local\Temp\1b5b2959570cded90de2026af45870f9.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:2816
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:3732
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4852
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1316
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:2784
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:5116

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        15KB

        MD5

        f5e7168ad72d9e70c4e63685fca8f6fa

        SHA1

        3db69fb480993b23e78ebc37fc96c6fd32ae7559

        SHA256

        aac7602f5f9b4fb46b3a485aca3159dfbed911aaaf27e23802d9d57707c6c469

        SHA512

        51e05ebc6fce4e2d6e236719c7d2f486358e159882fee3b661fc2f54622346558a17580ea85d437e4a4c66822863f70ce29c3494b4985634c69a3316a6cbc133