d472e6a48a086160dff10dfc116b493da32c98268652f5fb509fd010516a62c4

Analysis

max time kernel
1s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 13:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

238c4f4cc8fe2bb226b1a2cc025a83b4.exe
Size

68KB
MD5

238c4f4cc8fe2bb226b1a2cc025a83b4
SHA1

5f7bf26fe3d903c6d7754a2ed001ef1719169c85
SHA256

d472e6a48a086160dff10dfc116b493da32c98268652f5fb509fd010516a62c4
SHA512

a8afd183326cdafe2dd1d53a59d65fc9f24183a37bd7a6ff7b36bbb7b56fb0cd7b50828345a1c191dfc8050e969c0a5851a0c8f1a388b23c52c0957e66dc81e4
SSDEEP

768:wcUliTda6Al+qOQSgFrhKo//WomvdfQXwYt1IEDIefZsK:/UIxBAcqOK3qowgnt1d

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	238c4f4cc8fe2bb226b1a2cc025a83b4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe"	238c4f4cc8fe2bb226b1a2cc025a83b4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3204	238c4f4cc8fe2bb226b1a2cc025a83b4.exe
3204	238c4f4cc8fe2bb226b1a2cc025a83b4.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3204	238c4f4cc8fe2bb226b1a2cc025a83b4.exe

C:\Users\Admin\AppData\Local\Temp\238c4f4cc8fe2bb226b1a2cc025a83b4.exe
"C:\Users\Admin\AppData\Local\Temp\238c4f4cc8fe2bb226b1a2cc025a83b4.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3204
- C:\Users\Admin\Admin.exe
  "C:\Users\Admin\Admin.exe"
  2⤵
  PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
12KB

MD5
8c0a9ba35e5a1d933aef25e5f0565846

SHA1
a9e5dda063f8f3136d0cc52591c36094a2b76ad1

SHA256
ccb531593f3710786d16e1da7321101a219db24828469e6da4cb82f749adaeec

SHA512
289a8c2c821dddd33a32c4bfd44d2f389947cb24dacfef3910c0de40af93ffbdd3a00817d362d93a5d40433274c21b148ba0af62175ede79d75114b87bdb56b9

Download Submit
C:\Users\Admin\Admin.exe

Filesize
33KB

MD5
cad80d39274e65713d4932de9e9bcffe

SHA1
784a76b6da1c88c32b99162c9d80f8243afdc531

SHA256
7d84fd5f2ff8cf4900a0d34cc7bb9bf25230510b4a069a86454f74a04ad562dc

SHA512
c4fdd0f5d8c43f780f5a6fe41bb6bca33c77523a19fd15ae7a3a948327549102c3c4e29a5187b705cda15b5e3dbd4feabe942e287a38afbcce047aebfa70d211

Download Submit
C:\Users\Admin\Admin.exe

Filesize
26KB

MD5
7c65ee443dda2c74ef6f761bb1a3276c

SHA1
9dde6e10403dc2f9ab692a8d24c376ee14cbfc45

SHA256
27a8d753aa8980158a5120da401e395d122fe32db2a7a14e7c7726d211a853c8

SHA512
e7d23a12b8c7e078b49cc10f6bf1fb2e770040a911563d32436c280dbbb3e37d66e1461e5b2ce6bcd0331f74bb3d26e432251335a78d134949cad79c5c36572b

Download Submit
memory/1868-33-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/3204-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download