Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 05:19
General
-
Target
0fd5b9b452678ae6eae726cce2a1f991.exe
-
Size
55KB
-
MD5
0fd5b9b452678ae6eae726cce2a1f991
-
SHA1
a78ac2ecce8a00e853422277f78ebd89854be5e4
-
SHA256
781d7449f72545fbcf74b6dd95f682a655621432aab9beba7648c9b9d0a59b86
-
SHA512
aa76020a53adb3337cc4d1e4bea8551a8812fdf327115e86d8f0a67d439dcd31e1db7d62c0d2e1eeeaa095b75755ff05e81860f0c285d4f952f3b7aa18199bc0
-
SSDEEP
1536:zzFnuM5luIUYTEE7punsUeS6m/r/8Z3Leq4SoyISbN:VfPUSOZ6QrcLL1oyISB
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd5b9b452678ae6eae726cce2a1f991.exe"C:\Users\Admin\AppData\Local\Temp\0fd5b9b452678ae6eae726cce2a1f991.exe"1⤵
- Adds policy Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qttaskm.exeC:\Users\Admin\AppData\Local\Temp\qttaskm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
56KB