Analysis
- max time kernel
167s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
08/01/2024, 01:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe
- Size 8.8MB
- Sample240108-bfc4ssaeg2
- SHA256 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1
- MD5 aae04e4d6ce1c2585c5ba28162d5255d
- SHA1 1b6d53b3f292dfe9914d5dd8199d5e8c46608f10
- SHA512 b38e7c5013315a256307213bbb067c2535ce32cd2ea5a8544d26b6dbd85af7a3351d0838e5afe20930b133c63aefa7f7a646397b06d332a0eb24bfc5ece8f6ac
- SSDEEP 196608:HlSmvfRzmBkkTJI3zPUlVPMFLOyomFHKnP:HlfIvcKPMF
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe 2280 f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe"C:\Users\Admin\AppData\Local\Temp\f0dda5cb6d967b2abfbe6dafa2839b5ec15a2c40391164edf49ee389498681f1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\clinkm2.data
- Size 4KB
- SHA256 3613839f32e81431f8763f62f1ef542d0417035628837b3c05c853a44befaec1
- MD5 65d1c73f3b8f446e701ffa402823cbb7
- SHA1 02182f498e2363d35f3f57bc33b6647621561018
- SHA512 d1e290506640dc8d23416323a4bd1f33367af66a5ca264e3fa44df05790560e5774974dea9acbd22865563ea3520e5a85be3e58e1b5cf86268cb8d32714b7f2a
- MD5 SHA1 SHA512