Analysis
-
max time kernel
174s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06-01-2024 10:42
General
-
Target
45316370c4acf18728aa5363cb7ca861.exe
-
Size
2.6MB
-
MD5
45316370c4acf18728aa5363cb7ca861
-
SHA1
dcacfe812e001b260b0c29e36a4190725b533737
-
SHA256
caee85b6b5716533b54047c8cd6bbe51589cb1429b54dcf16b613538a1efbc98
-
SHA512
d81efb8f2fdc1fdcaff49e87ce6923e8f9305240c6330958a7f8949a14ce89b1ae62cb3f8fdb6a2553b834015eafd8445cc0dabff347849cacebdd9285d4fc11
-
SSDEEP
49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/q:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/q
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\45316370c4acf18728aa5363cb7ca861.exe"C:\Users\Admin\AppData\Local\Temp\45316370c4acf18728aa5363cb7ca861.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5db96fb948310878fc8290e0f2934e2a5
SHA1fedb5ab12b575f54297da695b77f46c59214983e
SHA2560a15ab17527c176cd1b4ccdc3c5431c874c930491b74b6e72645759347bcc110
SHA512aca1105b54bdb5f23a9d4c46eb8393fbec2fde8d2f9b19813c9365576334cbf23b36a12a078e1acc7429736c9d010e21be26727c87feb79961a2e2e6332f6810
-
Filesize
2.6MB
MD500b0975267a35710d046effe333ee395
SHA16ecf529a8c00643c92dbee57fc3df6086cb95e14
SHA2569a0d094ac030fcb3058112fc5eee166fca1e6f30c416242d153f1150fad84ff0
SHA512165266324a062f6113b7d4b9b74a5c956fca3721a3e458c34e07bbe87cb8a945ba71eebf8817f72042f21d373f0c6d9f7ed0c0a391060a40e296f6564163579a
-
Filesize
2.6MB
MD541714a5680efd2ebc1639d8bef689220
SHA104eed80f5d71efef970fd5a9caa8aed26927deee
SHA25628aa7e677d0417a7eb1a581a90e55f172257e25df9903b02462d494272607afa
SHA5125d24d9ab751f2836e40138baa07603bb95bb8fd1bb6f4fbec0f2c476778d33c9acbed3fb820f187ce6f78e16131f3b84d9636d03d03b1566353556fcb8b17375
-
Filesize
2.6MB
MD573dbd8c008439623a53f2316d289a6f5
SHA12e4697621116f2345fbb9a7133e057f2e6ba13b2
SHA2562c7a16cc588308b07e7276f9106a1e0c2b698556526c6331b4ab363a87bb4e13
SHA512e7bf1efbe17b6670134265b531bf0d6381f4811c63cfd551056cc768f7d5b06cf88e888cbd81dce05827d1e9fb8c9118b15b62fe6c30127d5b456fa53dda70b7
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
3.8MB