Analysis
-
max time kernel
143s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06/01/2024, 05:30
General
-
Target
456844b2101210da7476e2e51e8d2998.exe
-
Size
4.0MB
-
MD5
456844b2101210da7476e2e51e8d2998
-
SHA1
95802ce9f817333974c81b506324ee4e02ce07b3
-
SHA256
ba1e8ef96683117199bf2719352ba88161fc0f2105165340599f1d2a52a390a7
-
SHA512
244646020e5e67432fcd4f967def1a2732149a6008bc3613fd60af8ab12b78399236a4fd3db9145dff1d00b50e39c98adca97eb7a5f22d8e86e201aaf67eec20
-
SSDEEP
98304:PJzytbQjlRePmeeekWG3MBW4pOF+Fo58jWaCj:4QR+DPjW4nI8jWZj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\456844b2101210da7476e2e51e8d2998.exe"C:\Users\Admin\AppData\Local\Temp\456844b2101210da7476e2e51e8d2998.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\RegistryOptimizer.exe/VERYSILENT2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-A33SP.tmp\RegistryOptimizer.tmp"C:\Users\Admin\AppData\Local\Temp\is-A33SP.tmp\RegistryOptimizer.tmp" /SL5="$501DE,3734389,54272,C:\Windows\Temp\RegistryOptimizer.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
171KB
MD5f88080099181c4c257cb4fbaebc7b6fa
SHA16d642cfd8b18795f20bfaf5db8513610461fdf84
SHA256d1b1bf623774567e0e892a2a707150098524066c2d523f149fa722ee644f69f6
SHA5123be2c1a772f9c64b2eb340e13bd2f2ab0499716b13b6652e207892af81db962cfe9274a2607adff4b23ff02975d981fb54f5ee1a75267efe83e4ea38176b6ad6
-
Filesize
123KB
MD560566afb3daa7d9d8db0b08b648733ed
SHA114dc1b3c61a0fa6b4f0c2f0e67b3021ec55cda81
SHA256cad7ac9cd0ec7d40f3dc893755598567c8d132bc825d1b947b578c5a865624dd
SHA512df8b07231b07ad1df1a8f8b7013ee4d19bac7397a22e7e0023760c7d874f468d67b35a7a386e6dd43064836952e992f4f417cbfbb395e0142fc7bfaa11f1c1bf
-
Filesize
293KB
MD5140318efc54a9d117b7fa6d27288cafa
SHA193125c113f06965731a3962a17a2451443ce1a0f
SHA256b5ff69e462e7c48a9860963abb950f13245e9fcb8c0aa195bc4fa3788662d4a1
SHA512a1363a001749165656507ab21d7e0968022826e4810e3d6bad956394b66b5b2048704e826cb2591df17f7346c1bb32988f695dc63a63792dbfa9360753091e50
-
Filesize
70KB
MD5bfb102990bc75efdfb64588fbb0b789d
SHA1ea5a2a4f70342c0b5274a0b5c924213be2d1e5d9
SHA256e27875fd6592d2d86aeef9341195f465b11265f2b402ed0bf9fb32a8480a49cb
SHA512e40c4efcc18cb5f198a51e3c589dbf1817bc2970694c47e5a5f08262df15b07f9818a4cdb4ec342ae6a49be2c2919d835f2de0b507bb5772dcb55692efd66f04
-
Filesize
66KB
MD5a389128dfa1c71d8f6957425fee241cf
SHA176155c1a119817b2da49526dfb1a9cf46005400c
SHA256b8c4eb02346a459ce866963591cb17de6461048e135138c2d7035bfda52a62a4
SHA51263607a556231aa2024d5d697beb84923d22ef9a957f12dcb609922f84e9bc65743d604870ecc071f41e3dda78aed03da84267c732c5677fe2cb9adda01f65d08
-
Filesize
130KB
MD5ca0c98558263208bf5b26d4a3607514b
SHA1b92d79f451f29a12e25d4343e6c542ef3aaf1a81
SHA25628b80d4d3df378780d5ced3f006b282336eb05a7c0722c3bf76c8ce0f8e52a87
SHA512dbdc2b72b31dd8956a3d8e31b8d3fd3f2fff25a8150f97ed33867d67621106b8e588a9aa64877c659ed1c2fcf79964b2e347cfc18b3e9da1624cf575b85a4f1c
-
Filesize
105KB
MD51e7ed61ab7ba95e740318d1803881aa4
SHA1549879858ef862805a18db4b44e55473e25f6b75
SHA256e608ccb2bdd944e3813cde88db015ceef5d004edb027c8ed32c693883a76edd8
SHA512d70e04792cd62858a1111b12301279d913f15eaf0a68dc6a4002f6753339cf93bb408d350d34173fcff48ad6aba83fc1ae3392ef353b9ae640c419114f5e03f6
-
Filesize
4.0MB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
4KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
4KB
-
Filesize
744KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB