Analysis
-
max time kernel
0s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/12/2023, 19:23
General
-
Target
379c2b93eabee044047c1261e9aaa2ee.exe
-
Size
512KB
-
MD5
379c2b93eabee044047c1261e9aaa2ee
-
SHA1
0ce2abba7e5a3f5586b7d863ec91d0369640240f
-
SHA256
eeaa2181be19dfdfc7ce17d5eb82a8c64693c536d012bcea9b3fce67a8e4c73b
-
SHA512
59ac957c6440918a631578c3ca52594b01d520d56a82965cf3da54131f64e3adec98d8e72fcf4f42870fdb7f094847c9af0414b46a0441d9c71cdad804f48b41
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm55
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\379c2b93eabee044047c1261e9aaa2ee.exe"C:\Users\Admin\AppData\Local\Temp\379c2b93eabee044047c1261e9aaa2ee.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mzimowwtnj.exemzimowwtnj.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\oicuxxdx.exeC:\Windows\system32\oicuxxdx.exe3⤵
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
-
C:\Windows\SysWOW64\qyctqnedhzkwp.exeqyctqnedhzkwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\oicuxxdx.exeoicuxxdx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\wdebdlxjbsiflgx.exewdebdlxjbsiflgx.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD5b0e3c4cd1d947f65bfe68daf4ed41930
SHA176d488b8ad2cb9d5878505289a5b34c2b77a3ea7
SHA256cee5124b10d617bab9b0e8943c57cc4d157b17fbb655c8007264166925c48f24
SHA5128dfa39ea5a3d6496a15e85ba4d236eeebd453a82cb0a3640759fb06098dbffec0019889f5b46ae1db07024ca9f7209afc8de4b045496f31c9c3e6fe4e7f81951
-
Filesize
286KB
MD5306f19dbf1664bed7c00ed32e114e7d7
SHA155d2763f765b4c237d6959c24f7d6aa044d1bc9b
SHA256a6e72d1040666718af2b5239868070432feff15c40bf8fb292a15a2aac1224ab
SHA51250e5fc5e715f9d267b055ec0e24bf4a3ccfda007da6b95de56f93ac6a8549258ef3cde46622be5d26cc888245b7ed290fc9f9db733de75d0caba27123adeb237
-
Filesize
239B
MD512b138a5a40ffb88d1850866bf2959cd
SHA157001ba2de61329118440de3e9f8a81074cb28a2
SHA2569def83813762ad0c5f6fdd68707d43b7ccd26633b2123254272180d76bc3faaf
SHA5129f69865a791d09dec41df24d68ad2ab8292d1b5beeca8324ba02feba71a66f1ca4bb44954e760c0037c8db1ac00d71581cab4c77acbc3fb741940b17ccc444eb
-
Filesize
3KB
MD503ef85af5db942208f9124205c87468d
SHA1880d273d5bfccded51f5cb54bee66ec536db8f6e
SHA256debf6513533088b66553c655c86a234eed142b73f5028901adf97bcc4e2b7c10
SHA51260b2787ca38b590dd2640245e4955e0bebd0a46ea790c51b0baa52f0f48ae694ee5d9f30ba950cec51a5490469e04c4835fdea16e672ea104177974ff43d03fd
-
Filesize
3KB
MD5b8e25ffdc202e3b8efa50cba08218499
SHA1fad7aa1234c9e2028166a50f5af57d757f47e8e8
SHA25640d076bc98b335bf08ca222aff054c40ec98314077316900f078b94f92285722
SHA5127eddfb4c6ce5a6cf54316cc57a5fc837e5116c1e06e4426acc1816271b7f30d4fd1ca888db9b2b2e76cb15b355d84bc1af6bd9f72f42ea9ee75fbe5730a036ef
-
Filesize
25KB
MD53e1fa54900ec5e3ef1e34b2254ec98b4
SHA14c3a28beabf67d841e086fe8c5979c9b18620d8b
SHA2564dd487fa31aaefedc1387fcce397a493f6f9fe4cdebb060cba02eab7dfb711d7
SHA512b509000c2cf34f920c63223b0a7ca29977662822e5b5e4ec6030a30acdfe1589357b1b7ac62d536d38e84c1f16f4a631ac9e99f3b16cb7bacca22a18574324b7
-
Filesize
14KB
MD56924f6b0471c25f32b2bfa46db9823f3
SHA173bd2c2acf8b4044e30ff396ebf94d86da5a6e54
SHA2564dde2793ef857bebcd65a82c341c069be58ae9bbe099bafa530e348dabb2c903
SHA5121d9e2c0e083b398b4f793c386200974a8a6ecdd985a35de96ef0c0b473666a581102a781b717a6229849948557b06732d63d3519fab42d09e085ce9c2cbdee7b
-
Filesize
512KB
MD533d2fa6fd6cc756a23361885daa965bc
SHA1966dffd618b6304a3ffbc0576e0d50b09063ca35
SHA2560746cf6cb109ec1a748106a542f34023777effd8ef53a7e8c0fdd28eb57c486e
SHA512cd823574fd57333a1efee2c551aae14817d53d55648120c96b95dc13c70373b9dfed3efa8c3acc2043ab222336c57e6853040917b37603a6c7702b04c6adbaef
-
Filesize
323KB
MD5eb038d10358203a7c35ef4424755e06f
SHA1db9d1f026393b3978098e622eb112f983ae61d68
SHA25667abbde65b5ad463d3290768c0fea265b54d95e9701ed1a9ae2a2ed286148988
SHA512b4f6d977879e88026ac3020152c9b3062444d6c1ded90f3ffb84cbb62a8a260d3c442e74dfc4316dc4d2b7a58cf800e4aba5f5a2754df3a4e8b4ef3a3b35f0fa
-
Filesize
293KB
MD5a7666019761e2f675f35f82b242a54d3
SHA10d683bc0bafdb3827e625ffc6fdd2981b39980db
SHA256d828b506685f391f9fd9343cffcaadacf1b6099f473db25eff24ee282635301e
SHA512aedffc154034bfbee68e5c5297e75f4f8653db82e8bdf59abd75eb4ea7b1905031c228ce00c398037a0f179bf6d702fec764dff9a62c9854fa9e7f60abb38aea
-
Filesize
477KB
MD528910495a61e18a0f794e5d65626c43f
SHA10532457747b50887381a67370263d5a3838cda43
SHA2569bbf1fd2735b2ea8e09d93e7dd2a78ebba6f1db7b5b984a267311681c55a35c0
SHA5125a8daea2fc789e183fee9d602dbb3e5651aefcab0e64db59118717b4ead803d0cab43d57cc1f5aef0638bffa2210022cde3a601da5f4778f147e6ba2e896d832
-
Filesize
402KB
MD54a96cd64755deb7c93fed49023161ea0
SHA1159660dbadc1ac4c572a3bfbf24b44156eabc8dc
SHA256c8bf31b0d162f5edcfee61d1ff4ee8c37d19c726f96c97e6a38d80b7f8b3a11e
SHA5125c286824b7f7d15d0365b9e59cfeee3eb1877df5a5aba1b8bc0f722ef4e11cc746a68aaf2363d04382aabc9bc773427248b15e4cd4293d1853b3d3bd32fb0926
-
Filesize
341KB
MD5230a7bd8c21ddd8a6c40f21639ab6cb8
SHA138035bdf3b435c0252bb53681ca57616c9697d8d
SHA2560d5c4dfd74910ae8a5466cbd8304230b2d5da48ff60ddd27efcae1259adb6df7
SHA512eb6a036c21e77ac2582671a73ca169a22154ec091c479ca144931e82d004e9c0c7576088bc17d96add5f73871981cc3f9068116110972125d6100857549fafa4
-
Filesize
423KB
MD5ab00a598c3461fd0719a8cf97e677c88
SHA1ae9f4580c66e6445cd347637c893df2598bd8325
SHA2566b67887457e56d0961c990b4c284f221aaa40222a081ebbf4f7e280cae41a51f
SHA5123eaeac178e68baf5a0e65f077643ec44e198ea8c6f290b5eab2bedfe6310421612f8a92047a66edb7db8c4aa5300ff60398627735bd999aeb563908bbaf6819e
-
Filesize
28KB
MD520b09eba998650c33a2d7ebac070d9ff
SHA1944b807618c4c484e3eae7c85cdf5d174e5d03b5
SHA256be3a881b2cba63dafea7bfd23e108f1b5576dfefecf16842445fb1951541404b
SHA512ca1b48ea7ce524dce43014a9b4036d207cd024a6f6f48bd354e6a67c64dcb027b97cdd113be5afe9194bf423cf9d2e6e97c04137ff1becab83d5e3720cf62d49
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
23KB
MD53a709379e59c8d4ff6f3f301fa430d80
SHA183e854656ce8d119f2a5e7dfa58b858d3077d7e7
SHA2561ec2dbb0b32145513c9a958467aa7e1824dc41c43d7bf9119a407a04bbcf423b
SHA5129e2632ade77f0bcfb398c62375e042a6b9e2e5a206833e4d02800076abe4c194bd67e03394f6c71369a6cf24cc0dda43d9207ed2fc4914bd26804543e6515e9a
-
Filesize
512KB
MD5d8247214d1fb1b94a38ab45047a2ca18
SHA1a223a21d475bae47ad8cf4a2f20302316cca5155
SHA2560e1cc44c1b4c01c3b58dd2cf3e3492308a8cc64ead45f5aef44dbd99e9d9ca21
SHA51280060f947a7a8e4d85d8a85c9f7f2f0aefd3a72f2b1fa76b4e3d4f27c142542ae26315940056ec52eb77bdc361d8f2ce370ba9df6439e4b67b4b8d096c31f6a6
-
Filesize
6KB
MD5b944b01f42362732a6608fe1300dd9d3
SHA1f8110d3cec3b87d9c5d4ecc774cc576a742138b9
SHA256cc0c5f56bbe37ef240197cfb8d539c39947c306bdc6ef5a1c448218421de20b1
SHA5120a20fb974b5705969b65d52425cf426c614e03a9af09930200261f0616df36e9db252805b536d046773484e7cc85b088532d2c5048b5226464d4273c97c05877
-
Filesize
600KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB