Analysis
-
max time kernel
0s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
09/01/2024, 18:11
General
-
Target
4e7e8c49ed29224168e49cbb3bccda8d.exe
-
Size
512KB
-
MD5
4e7e8c49ed29224168e49cbb3bccda8d
-
SHA1
ae22807c092338804596714607f38e9aa031ecf6
-
SHA256
9626553cccbbcff6bdbdc51169559a5c5259cdea41fc71eb9551dd4300c6909f
-
SHA512
240449f08969e340cad8530c37ca3743f98c7662d919596769185e94a398ea2a5ccb84496f66b7b5acd71db9aba02a4fef072036a07e4fe00acc887d57d234f1
-
SSDEEP
6144:1VY0W0sVVZ/dkq5BCoFaJ2i5Lf24C07N5OvSLTUF6pQxI6Upe2cBnTu19bcodj6m:1gDhdkq5BCoC5LfWSLTUQpr2Zu19Qm5N
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
AutoIT Executable 16 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of FindShellTrayWindow 12 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e7e8c49ed29224168e49cbb3bccda8d.exe"C:\Users\Admin\AppData\Local\Temp\4e7e8c49ed29224168e49cbb3bccda8d.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\zkmgmarw.exezkmgmarw.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\zpajqqwymgqva.exezpajqqwymgqva.exe2⤵
- Executes dropped EXE
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
-
C:\Windows\SysWOW64\nbtccaxzqxodpvz.exenbtccaxzqxodpvz.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\upgtypcnyr.exeupgtypcnyr.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\SysWOW64\zkmgmarw.exeC:\Windows\system32\zkmgmarw.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5936d6f74af0543516a5a69c9201f1405
SHA1409a9f7cc7cc7bcf883cb8ed9fcb3732bacee872
SHA256a1ac1a8f148520da5b37e5931bd1085a458393dd944c03b8c1a92c75c818673b
SHA5126f7597964b2b3535bda69bd8d4a81bf80b45db074e44ed1bfc31202957dc883b12806f6b6f5242710cbae7e868e390a11867f34daa14e4308ddba545945eec8c
-
Filesize
239B
MD542033c511bcc7e1970e3c45cb786f794
SHA185fd47e439588b9c25090a0b4e80708c70652403
SHA25662d541335dd2c855f8cf2c10b799aa5b4462fb9d799282a6a6acf5a747bdbfc6
SHA512c121ce2191dd3d934458ca89f7c2a9b533081e0675d1deaa703539b61424a3c47b8c2138bda3b31ecfcd05c520a5a23010e4c6d6b0e2d4c629ac76b22b163b26
-
Filesize
1KB
MD5d0c220cce0d279348d41b4f95e3911ae
SHA1945bfd18c6a074f52e835fb8c83736e37c6816a3
SHA256ba9016ef46bef2d80d426afcb2dc18b449fa7d43ce9edb98a2d3d85986220ac8
SHA512adf18ec1e3d0545df9bd518e82c73576540bbcf43c9aa93b1c50ef6f1735b01c53e14ca7fa0c4cd843f1251327043763c733a7388ac1e7b7aeb6ed0d00f648d7
-
Filesize
3KB
MD546b7dbe0ba44a0e4bcac44000b13f01d
SHA15085125fe598f563c9171565027914d0884afb36
SHA256aec019a263c0cf99baf8d27accb9de3b62565976b2190de3610c768220150bd7
SHA51258234252f1da021446c49b54f233057f4234a1377e5a5934a3e8fe7491c09a91d846717e25bbb1e653505b2ca19c5a54ac4c38cc0a1cccf19fbb3a617b8fd8f7
-
Filesize
36KB
MD55d938b9fabf6ef6223a301443a8686ba
SHA19d3b605b3bb5c51a59f7c60db53fc423c1664f60
SHA2560a047ede9e4c42c675772e9fec1dce9e130d2e6503309e253a381454ef0adc7f
SHA51287378fbff53d08fa55ae3f28cbe169c79dc2424e91c68551dadb2b25c689089af7e143823e33cf25b3df709620a4232b63c6f3b3ea2fd0cc03781e3825d5e5bf
-
Filesize
6KB
MD57c64e5eb75ee081e8f37032e8c04ee4a
SHA1210d45ecff2c1e02f17329c82b0d705f35a24200
SHA2567e7c16a47f65dc9e2eba62ea5576565e6e9e06017e17b300bf71c96d287112c2
SHA51248873fc4394b0b1f8799476390cddbfa8c6b7684ec82905846253b564e01e24f8fc15bbc4acf3f307ce9fc5ee4181e3d443d2a4e3b1044c3436948befa5719e4
-
Filesize
99KB
MD55a2221068a293666e44f3551d6c1509c
SHA1c89025592e973f2143427f87fa1b83519a503dad
SHA2568a3b10d6f34ea1d350a71977560340e8d92484f71e2a9d7c2f25b0f94693a538
SHA512216d301fa9ac9074f563b2105c7a554d03ad7c4ad721eef8ac0153ff2f002527c5df1854abfdcccaaec4557703bab2442297a94bbcaaea4ea548576ee231965e
-
Filesize
51KB
MD595b3baa27b2a9b2fbfb48640afc1109b
SHA1a21c5d5af0f58763fee192f021abe1dd0e7ce3ad
SHA2566e51d6bd66e7d494b02099859980ca541539e9961627f9e078142c5af358b846
SHA5126b6d005f724c8d6849a916c9cfa6da6a68998db0987168665fa618d65eb3c748c97d2b6c091b28733f2f1eaa1c77d9e63f0d757ff0e4b4cef38f16c9ae3223d2
-
Filesize
30KB
MD59e2476981018feee91babf94db1d859c
SHA114c69790bf5a4fd12ba58698203ae7e7b351de1a
SHA256f3e1f3ab589d5cbdfb14186e3ea83917c7f36cd3d3cf693c59ab92ac1891f794
SHA5124f025e45fb649a7f805eebcf74f533150122a94bac2993ec4276053eb145eb67e6f4b237dfe34bb43012122ec2a11e35ab0d0e39fad440a8e4a5f82750013cb0
-
Filesize
3KB
MD568a1b1dda88a6e2fee8d9799c79b0cfa
SHA1e5ae2d2bf2bdc95f53710dbeade17cff53bf3af0
SHA25644b109dd87e151c9d6f654233f6c2c540cf9140c5af89ed98a4ed15dccc7a9bb
SHA512fe293faf7ad87271030bd34a69133cc5d06a3cb9764775eb3b3bfc0fa1c469f22b29a3d89f6b65af9f53fb9feba1259a2ceaa5eb6ac2d7709a18350b29802b4f
-
Filesize
17KB
MD52374affe677c6a42135dbb0a76508a6e
SHA1da7ba2cbe6f326f12f406d802c3713c8ea5d32cf
SHA2569bcdfbecf400c527c832e097622cc3c51a3c5b591fce20733e5bd04d4d407ea3
SHA5126d19c71f467d98899ad9fdfed259bebb12d38fba952321766a26a86f44d2836e1055162793befa44ae34f9321e6afc763962449a714fddf90ad794a8386e855d
-
Filesize
51KB
MD540f2a66eff34850cdaf8b01d65bb2c01
SHA11013f22efc0fdf1664c3f26e633205b5c986d4bb
SHA256827e5bef793018db36812f00f7428449e091e289f0df89ca22c762fee9d68a1b
SHA512a628af4f77fb99776f62f7ad1f991a1e0468bc83226217cff9bd16c90025db089c9da3d3cafc46617c8c491794364120f3881df3c578ac60d7698948164ba97c
-
Filesize
6KB
MD50f293be2a22194cfff2b6a412669f96a
SHA19f6bb67f4452568889436dc8fa3c421dda9f41aa
SHA256a753f1160c10965a2afab2f6785105cd25ae732f0521b8d2adb77f4429f8403a
SHA51247afc7ed0aaffc7bf2b105289627a4489a81bf13d3e9f59b47c2f1f1635aa9286f2a81b25ee6e80cce120640c52c5e69878e08f9b8433dafe655f648a55173ca
-
Filesize
5KB
MD530950acb03f004ce7c7282f5e8a17df0
SHA165837caa1a4763656a9a5d348b53adeacae5cbcd
SHA256c953ef33aba1586efe8502c8c30f21f445c183c6634ea359778dcf1be2190b7e
SHA512945134c7a54fbe1f4ffbc672309e4f6ceea39e7b41abf32f04c5ff589894637b859f805dba5edf1215f987b18349a25de10a0835a67cdfad2b37186a16c1e865
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
32KB
MD5f9f424d782bb8ba955a489ada125563b
SHA1d2e1141ee39c24d4fe8612ce3d300a0fa0a52885
SHA2561a3e518b49f834b1ce257845d7d6b1763bcac3c6b5b936d493978d899902dba8
SHA512fc95e84827b9bbcb52e314738546e04a51797e6c0389526b9487c74401a39a551edf934408f74d868320d437afd5035aee1896e5b0d669cc5c0c72754596b76c
-
Filesize
5KB
MD58b75f548f625f5bcdefd8a002b413126
SHA1cb30cad9b1eaab56528f063957982cd90c824589
SHA256c8aedcde02051e1e93dda61a7e73daafdaf8ea9ff0458bc7ba8674a8bea7058b
SHA51220212c80e77f458f4593d3b550a5b9a63dd0a34c6cb10dd0d450c0499da530baaee1839f5ae328313fc416ccf0b51d11205a90e576f43794f18af895b08be1b8
-
Filesize
42KB
MD58bec06a92c1c780bfae0d54c5b2c9f40
SHA136a5868b22acb1c2b1dcb15913187a605bded188
SHA256587302f73b9f8842d6aac8f94c54ffbd3fcaef555ec5909362d9e9aaac26cb33
SHA512e86c2027efc6ff0c575cae096434094182fa24f89d964f44d5483827d67db6592eb002f8ff96deee0e1b23eb9c98f5c7a9026effee1ffa7c36f58b2add981b4c
-
Filesize
25KB
MD5309f437bbf3ffec08d6a6f4605d2d052
SHA1adedd528a3fb8a5a311c52d992595ffd1b3ec421
SHA256909f8a8a19fd8dc24a1699319667a5e25f134982c2659132223d8df5ce9bcb75
SHA5124a56d5120b1ece5ef6dbe1ba6ccaff9a980add0ac8a5076904dde346d6fb601ffec2c32d8c735b2e054059bb816f60755f92bcc87432b7af71eaaac837fb3cf4
-
Filesize
600KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB