Analysis
-
max time kernel
3s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 10:04
General
-
Target
15eaaa2c0905d9b29e91547b082364c6.exe
-
Size
371KB
-
MD5
15eaaa2c0905d9b29e91547b082364c6
-
SHA1
77df4a30d68453e2c4448136cd069014dd7e7a7a
-
SHA256
58dc625c75f42dbf698a8f1107070f62f81c0de9966958278b72dce185fbd5f8
-
SHA512
b3c6b9fd2fe22daf276e950200c9057a3b4ab9e6155821e2e1a82ae2af6520b4fa61b290acace395a45cd9520398096d32bcce9f761ec2c936d5267639465d22
-
SSDEEP
6144:OuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLKUezTN+94IkNkey+X:F6Wq4aaE6KwyF5L0Y2D1PqLKU4s98v
Malware Config
Signatures
-
UPX packed file 15 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 14 IoCs
AutoIT scripts compiled to PE executables.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 12 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\15eaaa2c0905d9b29e91547b082364c6.exe"C:\Users\Admin\AppData\Local\Temp\15eaaa2c0905d9b29e91547b082364c6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ce3a501cbbfdc7a7844f8f779504a5e4
SHA15b32a366304b8c7a6496a7fb5c5b3f7bb87072f0
SHA256688c4e4dbd77b0dcaf2d4ea569734f008e26c4bc3fac256e86a74c86612e7663
SHA512651dea4a25e511ee43de9f1c227c6e2851f9e8e6381d2ba4363c564f7267ca01cfbc060c6d4ed69de5081b5990fce1aa8d005a093c42206bc4786a602a0f44f4
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
5KB
MD5f3418a443e7d841097c714d69ec4bcb8
SHA149263695f6b0cdd72f45cf1b775e660fdc36c606
SHA2566da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
SHA51282d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB