08a3a395a92a4bc50c2023dc3ab4b118beb8155e1fa2834113121b4d48b0702e

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
54c6d2add8e3305ef20f8c2d2d720f5b.exe
Size 479KB
Sample231226-e9jp8agae9
SHA256 08a3a395a92a4bc50c2023dc3ab4b118beb8155e1fa2834113121b4d48b0702e
MD5 54c6d2add8e3305ef20f8c2d2d720f5b
SHA1 b394bb279053d97a2016d8aad1866916ee646dfd
SHA512 5f538829c4698bed8d0f2c62215e1cb7ef3e19210743c02871f649e8731a1dc3150a60a91f6d4b0cb07c4909a483b9910f1e90533888bb515850d4b8a798b140
SSDEEP 12288:rtOzkjUBvCkfmvz756FGtkeSUknzp7tRuvftbOb8:RwkjUV5a75G0OtXggb8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

evasion trojan

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3516	54c6d2add8e3305ef20f8c2d2d720f5b.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	54c6d2add8e3305ef20f8c2d2d720f5b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3516	54c6d2add8e3305ef20f8c2d2d720f5b.exe
3516	54c6d2add8e3305ef20f8c2d2d720f5b.exe

C:\Users\Admin\AppData\Local\Temp\54c6d2add8e3305ef20f8c2d2d720f5b.exe
"C:\Users\Admin\AppData\Local\Temp\54c6d2add8e3305ef20f8c2d2d720f5b.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ActionEngine.dll

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\ActionEngine.dll
Size 1009KB
SHA256 7da9d3591d9b319484e4f651a1218fcfce6254315c2dab77519c11279ba25ced
MD5 9f33f5afe6693f5ef2bab1ff9b68ca52
SHA1 01b12b2c2b389d2337548b6d41a11be4516d8039
SHA512 221256a8048a442322e2da961add20e46ff669cab29274e41824d00638a2ca3ce0b29a3987856db891862983e5cf8d417d113fe7653ae62ba47d77f3bb716cad
SSDEEP 12288:2qTso4JT4In5Xsfepnp22sjRBwr6/rsFddRBRMT9riflTjfUjBm8+msLjcK:2qTZ4J17/7RBRPKYtnLYK
MD5 SHA1 SHA512 SSDEEP

Submit Download

api.js

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\api.js
Size 5KB
SHA256 e68cb263198cf8cf93e5a60be4ff091606be78b0963aca0e519732187ea93e80
MD5 cad20144ce29f20fecd6c21c5c61dead
SHA1 6bbaeb0aae32a3828cb77f8bfd3fb493803f3626
SHA512 35e0f7c8cb13693d7e3a221f186bd72613544dc75e5355550bd0e7ed7054831258c5a487d20b412ce646313d24b3436baf10597baa8a359a319dbeee26580ad5
SSDEEP 96:CzP2ZafkI/dMuBhs3M1vDNtK0lLmxNDbamt:HDbTt
MD5 SHA1 SHA512 SSDEEP

Submit Download

jquery-1.3.2.min.js

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\jquery-1.3.2.min.js
Size 55KB
SHA256 c8370a2d050359e9d505acc411e6f457a49b21360a21e6cbc9229bad3a767899
MD5 bb381e2d19d8eace86b34d20759491a5
SHA1 3dc9f7c2642efff4482e68c9d9df874bf98f5bcb
SHA512 abb2ad8b111271a82a04362940a7ab9930883ecb33497a1c53edcdc49f0634af5bf5b1bc7095bd18db26d212b059aece4577f85040b5f49c4982b468fe973c12
SSDEEP 1536:+vnXSI+9Escogo5uW8xbm5sIacSs0DEHUjnqTDUBu6VCdZWa:w8gdzIF0oDUstZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jquery.localisation.min.js

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\jquery.localisation.min.js
Size 1KB
SHA256 81bce5ff1003c9d5a688102d5d4c603841ed61c32628823dc48d560ec0d42cd2
MD5 f1cf73e00c240e9a4283201291d45a07
SHA1 918c49cb6f1de521d91967b2508f19db1f38fea2
SHA512 2242892434a638a9344c87453c3d2a66a880278dcf66f1516f240131dca767248baf663ffc9365acad26550e5b20a742d8115d5976de3a094d0229d60844788f
MD5 SHA1 SHA512

Submit Download

splash.html

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\splash.html
Size 1KB
SHA256 a358150647aaf4413fd2738c8ebcc0579b0bd4ccca8ba02738a4332a430f8ec8
MD5 0d0e0532f51af856688ad83abb889fde
SHA1 a1949b703816fa1bc60cf9c395d6dbb0f6f5c61c
SHA512 29322e2446ae5a37a34f113be5924121ce7d8fcfc617818f59c407fe7da01153845a947464345d6b86463b18c75d0adae1cc7dd5f17cf2d29584ef9539d8e0df
MD5 SHA1 SHA512

Submit Download

splash.js

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\splash.js
Size 946B
SHA256 bb39b6b14ae7f032922366943b342f58be120242020b1fa4dbb3310e39928823
MD5 354dce57695e99df9e6faba76346496f
SHA1 ca364e2daa4a80cfed7412b0f0374f1f82fa7146
SHA512 8f34ae59e5502c70659e358d03709cfdfd01ec2128110932910e8de16888857896e86707c279b3f67edb54059a08ab6ce05b742342e825e2894580ae4a4639ee
MD5 SHA1 SHA512

Submit Download

translation.js

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\Gui\translation.js
Size 6KB
SHA256 928571317e90c4d6680931dffaaae85f382069be2bc72b875810ceb1f7c2744f
MD5 682fea27f4c335defc18be6fb24d5748
SHA1 d4a1743d63508d18af4be59232f3d266228648fb
SHA512 ef70ad8c291fe10c8b1d0dc060fc50b4593cf6fabc03a751aa62d5f4e375b1c80184337816a8e50430964960fc56324259f8833707320c7b757e388ecbd28341
SSDEEP 192:J4sYciUyHKdsrZybt1Qy2VoJHRzslDy9t:YTHKcKQyz0ByX
MD5 SHA1 SHA512 SSDEEP

Submit Download

instlangs.xml

Path C:\Users\Admin\AppData\Local\Temp\IM_7B6A.tmp\instlangs.xml
Size 17KB
SHA256 2aa71646493cf47b38be0920488159b154eaf19193dc4a6ecfa0a6509196c7c5
MD5 aa91818150cfadb667ae6f914d43dca0
SHA1 4411bd0038ccd464ed7597f0540cfe04867b9042
SHA512 dd1310dc52bb6cc4977341dc34fb6a273e1349602a5fb3037e0b0d087b8f0d2d7a04e2db32e2708379758266c31422d27b5a35f5ba068cd7dbdd211b07893ecd
SSDEEP 192:z09Svkze6ih0RUJgYqEDE4WK9EIetaS7rRamFi3+S7rRamFi3Z:zHvgXK9EVta2R
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3516-104-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download

memory/3516-151-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads