Analysis
-
max time kernel
4s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 02:36
General
-
Target
0055aa189b96ff3ef617d06de37b2f4d.exe
-
Size
298KB
-
MD5
0055aa189b96ff3ef617d06de37b2f4d
-
SHA1
fe5689a42a20d074b400934a474e90b916eaf9f3
-
SHA256
27b5ab0b7cbf30c88f10796f198b625a83987ab458f8f50c88ad4f97529fcdc9
-
SHA512
9a488838eb2726b54bba3f9f05c882114db5ec4f5ee0d3beb24f3f416407eb5bf8c859979d32e6200a9c826d8b219112ebd729b8ce8003b4b1b58f69fc2a8d4e
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYo:v6Wq4aaE6KwyF5L0Y2D1PqL3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of SendNotifyMessage 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0055aa189b96ff3ef617d06de37b2f4d.exe"C:\Users\Admin\AppData\Local\Temp\0055aa189b96ff3ef617d06de37b2f4d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
298KB
MD540983aebe5b0d5d86c1ad35416cab204
SHA13fe95e9d58cd8a6af97b9897f8c8c6247a493777
SHA25654fd0760898858897047fcbd5ab70fc673695ea82e2f1890dd0f7bbc290cc387
SHA512d503280881d15f103b924fdd4c3c398fd79f20614a765c48070b69afd8af9056ee7eec6847572b7b6f933bcca56e2d8d705a3e8d52c8fe088f706da232d60d49
-
Filesize
298KB
MD5ee31f4aee09b1bd1ed513c8f10efe139
SHA196cb8285409064b7f2b7484017a647ccc348f959
SHA2565897bb4b9c0b657ee85c9ca12d069810a2d5f4f824a4aceb409bb11eb5996145
SHA512e1039dd125ab5ae4b42876a286a25dba0fa3786852692a9e516bac3d193fab8282ac6a34b544057fd2017211a8ed08988204b30462f3a9c09bffcbb60d5d2210
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB