Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 03:20

General

  • Target

    0cc46782416d5b4eb85f7675c679b03a.exe

  • Size

    24KB

  • MD5

    0cc46782416d5b4eb85f7675c679b03a

  • SHA1

    a5e5f89adeaefad4aade8b7f576416197f68766b

  • SHA256

    53f942eb67f92c6482a7ad6cd79ab72530bc0f6a603266d2e8e6c87ea6d0f7a5

  • SHA512

    72348df660cf77740c7aa3a5449713c7aabcb801ee792bec26613291a543d6485d4a1ed294be002e064520c9b10fa5b8ef930a665758058d6393363b6f6b4368

  • SSDEEP

    384:E3eVES+/xwGkRKJilM61qmTTMVF9/q5v0:bGS+ZfbJiO8qYoAM

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cc46782416d5b4eb85f7675c679b03a.exe
    "C:\Users\Admin\AppData\Local\Temp\0cc46782416d5b4eb85f7675c679b03a.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Windows\SysWOW64\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:712
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1012
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:3292
        • C:\Windows\SysWOW64\NETSTAT.EXE
          netstat -an
          3⤵
          • Gathers network information
          • Suspicious use of AdjustPrivilegeToken
          PID:452
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4300
    • C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start
      1⤵
        PID:1292

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        14KB

        MD5

        17daf79620b8648b0dff98aeafabec57

        SHA1

        8c7ecd236f4558c7dfb6959dd0b61ae527df1124

        SHA256

        e1e48823d8661ddcf722e039845ec225721e965f3506f23fe7ab62106338ceed

        SHA512

        f61c84af6cd4f7fde8ec94b1145c2ae44cc077dd6d7188d5d714a821beddf53b5fc775142c465231ec33d1c53a666a553e122df1d93cc9677365cf05efdfb9b0