Analysis
-
max time kernel
193s -
max time network
220s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 12:39
General
-
Target
18c9ed566d74339ae9f1d3dcbf6bc66a.exe
-
Size
661KB
-
MD5
18c9ed566d74339ae9f1d3dcbf6bc66a
-
SHA1
95c9be311185314b4c527155d962ba4f7a51aef5
-
SHA256
c525e551e65a72a4eec49f8f3413f8208c1354ad951323c46fc3bd523c42875e
-
SHA512
35e2e79b107b403e76609c0cb20c0cac5cfba809e853255de46489963365f344c84e8380b7f7ab7e7841b7b707782fabed3059eeecdb9ec7036616d26443fd11
-
SSDEEP
12288:h/eQy90AsyHaqspDg4tKHNBYY310c99BLLASjcmuGSbFNEkhOqloO3ZRIL2:DybgpoBtlh9BX9jTQuwOQIL2
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
-
UPX packed file 30 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
AutoIT Executable 28 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 30 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\18c9ed566d74339ae9f1d3dcbf6bc66a.exe"C:\Users\Admin\AppData\Local\Temp\18c9ed566d74339ae9f1d3dcbf6bc66a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe /AutoIt3ExecuteScript "C:\Windows\SysWOW64\chup.a3x"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe /AutoIt3ExecuteScript "C:\Windows\SysWOW64\down.a3x"3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /b /s /a "C:\" > "C:\Users\Admin\AppData\Local\Temp\RecursivOutput.txt"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe /AutoIt3ExecuteScript "C:\Windows\SysWOW64\dost.a3x"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\svchost.exe /AutoIt3ExecuteScript "C:\Windows\SysWOW64\ie.a3x"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:82950 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:82954 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575KB
MD537fdf31c6c0eb6555019ee93baaf33e3
SHA1fd7eba8a73f13d912d44e0517aac60eff5e7e9d1
SHA25654fc401285a3822b3e9483f40d24025c89a66b79cec3fb1c525826a089087b53
SHA51288165af7483854f4c2a0fc7444a0f6157a4db8b157943b7c3db2b74108e133674500e2d2df33e3ddbe77ea3a81d42876bc3a1e16f72141b228be4651a5af529a
-
Filesize
23KB
MD51849d480c0ac52b472aa9288ad2578a5
SHA1c925b03b73141465a9373f4f8648d4e37c58e21a
SHA256ca077591603ef04aa82e2f2e2c1006deac96a4e811e0dc83b4568c7fae9e221a
SHA512f8833f7b3f6f7d68f39f07883c780e7ed2f0aed5a7dfefa8a132069610c95b10bc839f8361f50d387c81095f8795e6c4da69afd7c3020198f45f30b0771a81ec
-
Filesize
4KB
MD57a0c0092cff3faf6329371e058fdcea1
SHA18157c8ef86a8c477fe0852f3d29ab382809b0884
SHA256872b7560d430147a63275e1beb6a437a36e2c07817847606b58f25c467025bad
SHA5123623f41372d9bda69a381d6e812a4ba8047742afff3ec737fd8c92348aa250d2cb2c7b68cd4c651a461b0f37dbca22e9d363e0f42c7687ed1405b033d4d128ea
-
Filesize
27KB
MD56ff435cebf0b76c70743be780e001533
SHA154b6368feaaa497b6302faf2f647f364368c56b1
SHA25681265851361bad5ed6d02aeed2ced6d3d444bc349c366563fa20823985bece08
SHA512d8dce5d122660a7bd3dcd2128b616cdeeab93b0d8dffa15e3fec5a6d0528f2d4bc1fd31ae967bc6a2113617db5e325ac8f26b67d3835fdefbfbedc97922a38ac
-
Filesize
35KB
MD5fb0ffda870fff07612244660b4080086
SHA1ab0934b89ba3d1f97dff3622d64d6b3231ddb98f
SHA2561629810aa1be8f11f80161a594f3adae6d3bb1abec61ebe9e8ce45880fab5840
SHA51272d04166fa9fc141e7f4eb9b33bed536315e45c154a32294eca0890c3ee418af084da7613414639082e5fddcfdc192b31ce87850dbc2596d0074a4c0378f3e0b
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB
-
Filesize
888KB