Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 20:43
General
-
Target
1c1488ee9cdf5b13cb7711149f0092ba.exe
-
Size
378KB
-
MD5
1c1488ee9cdf5b13cb7711149f0092ba
-
SHA1
23523b9326936327625afd57e1a093418d66fec0
-
SHA256
4e291ae7259a427555d5cb60cdbc5f5a12a82d35e44db7552ee64273edaba685
-
SHA512
6482f82dd709ff871f1702b947542bcc8b59231ad13a1badf04761863431a77e17c123517aae356708b4a1d4e4bb19c947e0a0bd395b84a18bf84b6a7e8ff9f9
-
SSDEEP
6144:CREPHiuLaPVRtZcE5ovGc3UP7GduorTh3HNdGu4uhqRLMy1EoWuUb:ZPHrKZl5sD3B5vBggWEdJb
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c1488ee9cdf5b13cb7711149f0092ba.exe"C:\Users\Admin\AppData\Local\Temp\1c1488ee9cdf5b13cb7711149f0092ba.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Documents and Settings\tazebama.dl_"C:\Documents and Settings\tazebama.dl_"2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5084 -s 7563⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5084 -ip 50841⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157KB
MD555ecdef2b36f3bd8672eece50394dc55
SHA16c96e7f5daa31978bb7382f5d4573d5b928c7e1f
SHA2564bea894f1f1bddba91c0c562c43aa4e0e81588330e8cb5839d59d133d2250d37
SHA5127a658e50b4f6b9f9a402b364c2f2b06413ed0afbffda954b9a210fc8f4578bc802fce0f8a718b4864cc0037d04ab9cccd83baee13984507177ac172832602e79
-
Filesize
32KB
MD5b6a03576e595afacb37ada2f1d5a0529
SHA1d598d4d0e70dec2ffa2849edaeb4db94fedcc0b8
SHA2561707eaf60aa91f3791aa5643bfa038e9d8141878d61f5d701ebac51f4ae7aaad
SHA512181b7cc6479352fe2c53c3630d45a839cdeb74708be6709c2a75847a54de3ffc1fdac8450270dde7174ecb23e5cb002f8ce39032429a3112b1202f3381b8918c
-
Filesize
126B
MD5163e20cbccefcdd42f46e43a94173c46
SHA14c7b5048e8608e2a75799e00ecf1bbb4773279ae
SHA2567780bee9df142a17e0457f3dcb2788b50fc2792370089335597d33719126fb7e
SHA512e5ac0ff6b087857799ab70f68067c9dc73eeb93ccfcad87047052380b95ade3e6eb2a7d01a0f850d548a39f4b1ebb60e299d603dbe25c31b9a3585b34a0c65a8
-
Filesize
157KB
MD5168fdb5fb7ff78fb5995b8025ee993d2
SHA1aefc9b873c55a4a3c7fc732c5e858379fc8dfb10
SHA256bc64cc2379c6e85184570d63e4d9c5100ef3704d66e1c923f0a8137876373c0b
SHA512596d7d1c001eb74865b17ba2739338e7acd9d04a6d49d30fa3ebd69d758750b54105c578e2254d2bd763a0b086d51be36838ea053bc06fabb6a37bcea241b87e
-
Filesize
157KB
MD5227682aa012ed286d0b1a5f4009f9731
SHA1205b9e5f3deac9fd5d6001f8e3a38957053e54fa
SHA2568f6b3443139e5296aeecd4febcb8adb51f2dc4f3ce61ee86dac2ace84c88ef37
SHA512400923ff62b5277298534d8fe455a4a4f18d39ab2a2f9d4d7cab30494e0c523f30cef0625d96648cce5af56e501e554c6ea05a426f6412d0e04de35711bf1229
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
96KB
-
Filesize
96KB