Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
30-12-2023 07:20
General
-
Target
11fdb7cd36201ecc62fd3a2f0c64f7ff.exe
-
Size
436KB
-
MD5
11fdb7cd36201ecc62fd3a2f0c64f7ff
-
SHA1
a4e80d33848bc58792caaf5a13f4baf7115af6bc
-
SHA256
e78a4ee8b5c5f8a155ac5ab04cd9c3e3efc0198c0bdeade619406b55924a4035
-
SHA512
cea3e3ce2c54d016e332488a06be6bc557a7f10c45da512b25484003646bee33722523753c598f9740e1afe6c84087c118776100097e6b8c3943845bd65ffff7
-
SSDEEP
6144:yCtpA8wWYrNAVZM9BzVIW3gdFQAL/CGHSBCEeNYlSaFHI9etA454F006UbdQ7ek:yXfWY8ZMDWjxrHyB5e+lFIex5H06Y4
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 4 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Windows directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11fdb7cd36201ecc62fd3a2f0c64f7ff.exe"C:\Users\Admin\AppData\Local\Temp\11fdb7cd36201ecc62fd3a2f0c64f7ff.exe"1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
32KB
-
Filesize
4.8MB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB