Analysis
-
max time kernel
9s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
04/01/2024, 20:18
General
-
Target
0ee4cc4d4bdc5809b3fedb586b701493.exe
-
Size
298KB
-
MD5
0ee4cc4d4bdc5809b3fedb586b701493
-
SHA1
8714d966d358a9600a415dbf56927fe66340ae9e
-
SHA256
17bc12aeb004e3f54e0df3528741e5cabb0d40925f6d80b875818a6a06868bcf
-
SHA512
261192c259f0e41983effdf31d78944f2db323028dd2a423fafed5c5d2cf9362b3163a80293c8430c11261c6bef6612968c792929d2d8fa81b5a41c8a61d1958
-
SSDEEP
6144:EuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYQ:v6Wq4aaE6KwyF5L0Y2D1PqLD
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 20 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 25 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee4cc4d4bdc5809b3fedb586b701493.exe"C:\Users\Admin\AppData\Local\Temp\0ee4cc4d4bdc5809b3fedb586b701493.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5e476c22733b6a14dcd84094845edff51
SHA18e7ed3d468d4fa5038e2a99a0ec6e697ad88956e
SHA256c9a1947d61379215ff4dc2ce32e4300f561fffbc919533d3f1221f17b56074dc
SHA5123a825c5da2c105020f35620e5119a4fbe3c76d2b46182a61bff7ccd60fa6243abf0250f2930794ce8448350b300c25da62593dae0e7a194069e28b8b88ced333
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
7KB
MD536e73ac0a4109cf8d0dc1636c0d5285d
SHA104454f00351f7d9ced98482d412ce2d45bf9f4f1
SHA256317fbee61bc696676bfe23d968957325611770f8b5527211f1ecfe84c9d33a16
SHA512051f395d79dfda24caf2f1db58c1d18899c31d866e3a86c4eef7ad3b3ba6ca702768e4b81a167991ede3a9972da256e89f25a8f95682a2b187b5ab00a43c27e7
-
Filesize
67KB
MD5bacd337a532d31d931c23fd54142ae46
SHA173eca801cb8a8a68974b903c4982cc768c47b3fb
SHA256a114526147a0868223df0220addacff1b9984839a364aa1f162ff8faf0774ae9
SHA512ab659ccd62f82880855692ca7d665a9552a3b5ecbf1c17b9775bfbd21bf4327bbc0ad9e2d5976768cc5efe068e6930ed7859ce3bfebe1cfe1a5fb765b770a50d
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB