Analysis

  • max time kernel
    135s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 04:13

General

  • Target

    4a68d23367d8aaf9fe9217f7f9f98bf1.exe

  • Size

    9KB

  • MD5

    4a68d23367d8aaf9fe9217f7f9f98bf1

  • SHA1

    8e19a4350906af12ba6f34affe77fa2b5f1a4ac7

  • SHA256

    ce7c7261c263db798375b793f7af834ed096a59d5069bad3e5cec3de388bc5ba

  • SHA512

    12593ef50dd44d94fbb3b3865299a8f27d83c045e8e4df4b0a16266a9c488c177535d84956ff972729273c8d341705e61a7a10af3b2877138a65655904a48413

  • SSDEEP

    192:UT5yf4gFTlVaRZM8ZpbN9+MB74tb14THy8wLmeR:U8QgFTDkZp/buMB7ybYHy8iR

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3512
      • C:\Users\Admin\AppData\Local\Temp\4a68d23367d8aaf9fe9217f7f9f98bf1.exe
        "C:\Users\Admin\AppData\Local\Temp\4a68d23367d8aaf9fe9217f7f9f98bf1.exe"
        2⤵
        • Adds Run key to start application
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1412

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1412-0-0x0000000000400000-0x00000000004093CB-memory.dmp

            Filesize

            36KB

          • memory/1412-3-0x0000000000400000-0x00000000004093CB-memory.dmp

            Filesize

            36KB