Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 15:29
General
-
Target
50ef93e4ccf69fcf279de3fcb8075f80.exe
-
Size
3.7MB
-
MD5
50ef93e4ccf69fcf279de3fcb8075f80
-
SHA1
5ab016854f0dc0f9b046dcd6d6e7f773f484be21
-
SHA256
5bf737b523846a073eca67002f280cdff3fd42b0c916811a2b3a60219de51764
-
SHA512
1b85312aa82d612c3e9e20cf802dd12fd45fefae2e64f3a947d1e52f48f7e6e331f72ea2cd5f2d2b91867904be7916de3f001023b855184e97ac508d31b6995a
-
SSDEEP
98304:PX4T0P3Jv4bCFA7frAJUyATxRlwz22UFpyazx14:vK0P32Myj2cxj+22Ipya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\50ef93e4ccf69fcf279de3fcb8075f80.exe"C:\Users\Admin\AppData\Local\Temp\50ef93e4ccf69fcf279de3fcb8075f80.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-ACVIK.tmp\50ef93e4ccf69fcf279de3fcb8075f80.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACVIK.tmp\50ef93e4ccf69fcf279de3fcb8075f80.tmp" /SL5="$A0056,3183062,721408,C:\Users\Admin\AppData\Local\Temp\50ef93e4ccf69fcf279de3fcb8075f80.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Voluptas\officia\Iure.exe"C:\Program Files (x86)\Voluptas/\officia\Iure.exe" 5fa3e4141295a83810d25683391a76aa3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 8604⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4412 -ip 44121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD5aaddfcc515b41d0f8337b712a873dcbc
SHA198072cb413d3568fa5b31dc8f11432e07ce475f5
SHA2566b138b513eebebf54eefa4126f3b655345a0d73d9d8c528b58a7115a03ffa5ac
SHA512244206825a29c70f3c772d70093c9b9db6501be2a8208ef88fa217e3684893b1b4d2283196086ec3c2ff517e6fb953134620d267b24ee89927a49b94f43085de
-
Filesize
390KB
MD5a2e44583ea3b9de2b94dd3ec59f1d597
SHA1d7672b6a0986cba2a26a9a2b3b0b7236fb44fca7
SHA2564cd578ed6bff0d21257c5af52527c50cd67e71171dbe83ce760e09c81b68924b
SHA5122368ca7d40466819fafdbbf0c6ebf69a945ac3dffc0575ecd1af43ee75fd80c2c1308920aac306059b157d2e3a31c6f91a8464098cf968fb8437cc2577239ba7
-
Filesize
343KB
MD5c4fc14059867ff1db19ec1a55b691dc0
SHA1bf29f851942ba3c03fdf9a3e3fd9d1a94ed66281
SHA256c1de9c0eb1a834e6d607afd8534056c6fbc20c4fa0a53e62d5478385a0412e6f
SHA5120306eea0e6dcda06d9a4ca3f774c2ce734196c5632d79891a022365584ec9bf62120123a8e024e7abb921c7a57ddaa8fbde1af0714da40b542617aa8fbe1bc76
-
Filesize
2KB
MD5711836f9151fe51ed49324df3c1ca111
SHA1c0a11291251aec53cb4477b644737ce411bf9b9e
SHA256fc21a23d2c636ff7634d6e7d45f8cbfbf09b11af9224c03e208f0912b008ef3c
SHA512b55bd7aec8fddb07c879b3affd19979fcc2840b2589d1ee4cd0a17f1f057aec15a291a7bedc90840642610f6cd89f35646c3dbd5bb4cd46495e38441a03ace9c
-
Filesize
29KB
MD56b12164cf3bf52ec5eebd05f8b6736a2
SHA11e5560ea857877a9e3a774b36713f25fe2e240f2
SHA2565e0aece0e65a07b97bcc1796dc00c68171f5707813c164c8d68288eff1a54098
SHA512f88d3644b66081390b6af44b0643b199dafc25e2e677fd531cd6462f996f31f41f5cdbf71974e6295b4766dec2580f16c12be039409d9f396885a277be5fe6d1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
4KB
-
Filesize
16.7MB
-
Filesize
584KB
-
Filesize
16.7MB