Analysis
-
max time kernel
5s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25-12-2023 13:56
General
-
Target
23887ee7e19c5eb5621dc6aa221c348d.exe
-
Size
298KB
-
MD5
23887ee7e19c5eb5621dc6aa221c348d
-
SHA1
114bbf17f2f23e3bce7bccfcb2a32a1a02f038b9
-
SHA256
12ab7206d26a303ad323fefa0b4da9b1e2059bc26f1ff1732e8c1732624dd05e
-
SHA512
77a2d9c17701481c7554ff5eed2fb66cf8701981c856785438b545748ebf55c57ef7e2135a68ea30825bf28d856cd19ceb5d0dd67a42ec06fc41871781dd5496
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYx:v6Wq4aaE6KwyF5L0Y2D1PqLu
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 15 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of FindShellTrayWindow 16 IoCs
-
Suspicious use of SendNotifyMessage 16 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\23887ee7e19c5eb5621dc6aa221c348d.exe"C:\Users\Admin\AppData\Local\Temp\23887ee7e19c5eb5621dc6aa221c348d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
93KB
MD5bd5ed1c8e4e4cf06b09197e949e0b0df
SHA1171ba30f2a2c96a9b8f6cba2959fbbbfb723dfc8
SHA256d868204510e4d5aeeddc6a78e672ea67a310dfa4e662797e667ee83bd84cd3cf
SHA5128a846d5d8bc3bbeebb06ca28db7262e72290aa1cf254c8305b712e33af293447ebdadf5e05e8b30e4d1913cc2962b1c62aeddca6040e473b1084706f5e3faba3
-
Filesize
2KB
MD56292b0fe468d3c4227e50de5485357e3
SHA1fe1538898099687446c9207e73fec76001703554
SHA256b3c2822e62817b800874e346ee03f0e58549bbf535a07a19c6c3018b3a122e94
SHA5126c99abef5eb533c1996154088e7319aaadafb19a65e12b9fc5bf000006124467eed8b15dbbafb9950bc12c4bd6a1cd5431519f76b99d8305b1d68b00fb336936
-
Filesize
71KB
MD5d896bccfd32f06ab823996984dd9623b
SHA1635c2d9ef0fc88ab67d8d274bc47e4337ec0d4d6
SHA2563cd1108bfd0f8b0e199f5326c1554ece42cbfc864c06831b15c04be884cda576
SHA512ecc8bb1a73025ff3aa6232e5b06663e223086fffda88c0b2618a22ab58a4d704586d181dab6618439eac4ff1f52631115abf30e67045bcdca17677b53c5d1112
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB