Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 21:22

General

  • Target

    1cd6959e32ef9c5f6db38e57f440ef09.exe

  • Size

    3.3MB

  • MD5

    1cd6959e32ef9c5f6db38e57f440ef09

  • SHA1

    9ed6c76181ab2940873dede7e932d698d3b85fef

  • SHA256

    3c9b4bfa9727b39a9a07ae3868af0b89df34c25d5e09f0a38cab5a239028f85d

  • SHA512

    2d2a5df79b7e103b99c4e0c15a3bfc43423c33f416e8daf0d3027084d1d3eb12f50bdeb15635298e894dd7f550735054f8913ad8b9c28cb86c117eedb1b71ed6

  • SSDEEP

    49152:M9Eqr58vFf+4jWMC50tCP36RktzuuTT+pwsdPd5XDv1TDIkXSWa6KPkwgmPm4GtR:pquvK1GtCPRhTT+xdPdlr1/nU9kwRLEj

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1cd6959e32ef9c5f6db38e57f440ef09.exe
    "C:\Users\Admin\AppData\Local\Temp\1cd6959e32ef9c5f6db38e57f440ef09.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2120

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2120-29-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-34-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-26-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-23-0x0000000074700000-0x0000000074CB1000-memory.dmp

          Filesize

          5.7MB

        • memory/2120-24-0x0000000074700000-0x0000000074CB1000-memory.dmp

          Filesize

          5.7MB

        • memory/2120-31-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-30-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-19-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-25-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-32-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-33-0x0000000074700000-0x0000000074CB1000-memory.dmp

          Filesize

          5.7MB

        • memory/2120-36-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-35-0x0000000074700000-0x0000000074CB1000-memory.dmp

          Filesize

          5.7MB

        • memory/2120-37-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-38-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-39-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-40-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB

        • memory/2120-41-0x00000000030F0000-0x0000000003100000-memory.dmp

          Filesize

          64KB