Analysis
-
max time kernel
0s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 13:36
General
-
Target
224060ce83ac44499c32380a5b060967.exe
-
Size
642KB
-
MD5
224060ce83ac44499c32380a5b060967
-
SHA1
6b7e98e8328b4ac25a11778a5ebc3d9a36a5c42b
-
SHA256
27af21150b2154ddc4ed6f40cdae5b9da8edd292bab0e3750ef19549316455ce
-
SHA512
9f6ccbc585190d062b67a535e2486d584edfce7db2db52bdb524ede00a626f7b8010ea4f694fae7278102343144d165c7151efbaeb4c511d4268a7bd0e507d6d
-
SSDEEP
12288:+jkArEN249AyE/rbaMct4bO2/VFYG7XcELoj5i4/7f0aa+Zl4sYkyxjqd0rIfyfO:5FE//Tct4bOsTYGoEQ5i4/b/a+Zl4sY2
Score
7/10
Malware Config
Signatures
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\224060ce83ac44499c32380a5b060967.exe"C:\Users\Admin\AppData\Local\Temp\224060ce83ac44499c32380a5b060967.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\csrcs.exe"C:\Windows\SysWOW64\csrcs.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB
-
Filesize
756KB