Analysis
-
max time kernel
146s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
13-01-2024 11:09
General
-
Target
58c504bfb3b88500ffb0714bcb5123af.exe
-
Size
8.0MB
-
MD5
58c504bfb3b88500ffb0714bcb5123af
-
SHA1
1b072fe6fe0cc2da775f50e66c7cc40c8a8b7426
-
SHA256
52cd8f65112cfb10bbd8f14eb27d793888c06a2e79902084f533e26438b1c0ba
-
SHA512
abcf7fd6d92806b4f636d4ec5de135f9743ed759afbf0ad868239786f012afab475704af82b4c712efdb5d5e6fc0fbebfae794e41cf88c814d118c064530ce91
-
SSDEEP
196608:n5fLZRAo93I+yO1d9eP2j8OkpvJtSi1zwfkikcQm1Q:nNYaYrO1d9Vj/kR3hNwfkiDZQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58c504bfb3b88500ffb0714bcb5123af.exe"C:\Users\Admin\AppData\Local\Temp\58c504bfb3b88500ffb0714bcb5123af.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kc0pyk2u.xwr\58c504bfb3b88500ffb0714bcb5123af.exe"C:\Users\Admin\AppData\Local\Temp\kc0pyk2u.xwr\58c504bfb3b88500ffb0714bcb5123af.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5b64b309fbaf6d3157f6eb219d62dcb9f
SHA1e2279b7b2af3b3467773b361873aaba00dd11fca
SHA256a0eaeebb816f4bd98d292a6f3b1d3efefa7b57be6c892a8c38198a1346bd0ff7
SHA51243fd28f351bd4bb668aa7b060b34ad4acd519aa746436f306c7824e04fd5768f0e843f5010bfee57bd3c74afb78d790bb0528e9d89290bfd7b583aa4b3cacc89
-
Filesize
193KB
MD5771b53fadd028318c651db498283f1b0
SHA102c3d698f99b1d93d3277326225a11b991ee666c
SHA25607eb7c3005cce07db8684bf9a5c3dbc166e5132b742e956cf9f22dca7b9e85e5
SHA512c32461e75c0d9e955d770d07746d9bd0a8acadc6350a402e875c730f04fc96cee697156ac266bcdafc19f7b08b29c45381790d581df64a5da94fcedaa6b6bdf7
-
Filesize
78KB
MD5cf87f74938eee1803cd57420ec021e53
SHA11fe9864ca3d48b5e826721bee65c276c064cc891
SHA256eb6f20af097bb06d14e1cd5374d639acc287149b0988a9f9251413d40dd84693
SHA512bcc92fb409d328bdf5fa736a2734ae28b422696aa9e9ae763169729fa34e2f790a6b5f8f33b33982707ffa00275089e970f0c8a1e351030fcbaef4bb05cfbc29
-
Filesize
2KB
MD547ee2f8dee1aaa393b6429a5056b218a
SHA19875e42e735621ba5f6946460b8afe5e1a11e2d2
SHA256487d1d1424781d93d4ae294ee177798102fc393bd139462cd17d6c250da57151
SHA512eb87341d8b88ca0cec70721d58878ef6e3ec50334dbe11d2528cd5f01c57c4fe3ade92a813457e9a5e46461ee1c78ff26e67a06bcaa33ce1679cdb2511af92f1
-
Filesize
2KB
MD51fe59e6e74c68d49f9b7338caaa81511
SHA19e4995f8550296fe7e4743d24df754636bfb8277
SHA256b09a2c7b3fde8e7b0dc560f06fd1943f2f80b5d2ac9107931014034a10013d6e
SHA51224093c10f2f4a4f92a6bc6583ba1df6189e3cadefdf974c8a85f909d93868736bd180c94abcb9bece02d8032e8f0a524bc2e1330b91c0f657029b73555215772
-
Filesize
54KB
MD53ca55b548876d810815f7515fe7a077e
SHA1f09e762d9dea7ef23085b0e0724f1c6194cf57d4
SHA2564aa3c0c62334ace27b1f1a1caf0165a146c3fb2c0b36a300e03aaba94279f89e
SHA5122e6cf72ad531cb74db409f59cf58f9b26a5d8adc0a8efd6858f127dacf07ff21d2e3c3a83f976ed95aadbe5c1c88c6463d2f6e5f648f9d61a7d007f5850c632c
-
Filesize
25KB
MD5bfee71aa548dc13945f99b292ccfb5aa
SHA1d5e69b1fca14ef066960e649b155687f0a8019f1
SHA2565287b3edbf14f4abd731dab1b7dcfb662040fce3eea7f573807ea77dabd3840a
SHA5124ef902d19d9cf83ceec982b2c3033d8e3cc1a1871ec3322fd550d352a0e8d9941cfa83d55062c914f9e67b2c2c78052007c14b37052a81ab5406188c9c8386af
-
Filesize
429KB
MD5b8895f2d722121f49dccb5711aa8c6ad
SHA182ccf62eee0f54b2ee49171fad8f463c2eaf015b
SHA2562ece8de1a958eb3fbc2c22cdbf67ebc265646b05bb77127cfe21bb51679f8095
SHA5128e4f1893e2d158d12d364de0be236bbe63ae2cbe82cc5440de2eca6f60a6009038711bb8985eb741675b937ff278d8dacf1a1b6134f89542b5b98227a6654789
-
Filesize
16KB
MD554a95794e8eeca63bd4528c49c8d29aa
SHA17b5d5c4509cc0427a3763f837c9559f77ee026ab
SHA256d657eaa2129924465ced171a5d8f83c921b100ad627d4bb2e0756f8f951d4bad
SHA512291c4db2a5908b00fc2ec03891b6cfc5096083dd9a41b1725361029e605f32c34236ef1271d9b07d26ded21e2711937ab7b270387b136bb9a4584c42d0960f1a
-
Filesize
123KB
MD5d3a5b20d5368c1bcabe655b57b52d097
SHA1015cf89260f3e8f0b86f5a17558125c933692989
SHA256e9cca17c4320baac34e9ea5a41357ae0baffdd1beed813c2ef1f82d1179e9868
SHA5121fd0889623b195a6faf905a2a662fc08173e76ac9490e2aaf9a96390f2184d71c1d5f29c61553bab34a3ea4626226fbd9eba4a2085afb5994290c31fb87a68c0
-
Filesize
1KB
MD5d7a9c65aacfbfe034005c1a597690d41
SHA19025140dabcd7c5f8fa61d4f738b5110f0d4a894
SHA256d677b1f0d8c069c659417288d226e27abf70b0a958ff9acfd97f19bd4a8dfb48
SHA51286ec223c2f7534b50b67f8b89026bdd83a8e68f5e66a80311090bf4d6d347b2013d555c1e41236dcfba56c73d5fdbd37b994ae74857216069c9113ae50628dc4
-
Filesize
2KB
MD5f723acc1b43be1515ffbc159f4d1a042
SHA18deabbdf18ca518313802374b69732bd03719e55
SHA2562602982f24c6914067cea66536b0cde3126b4d9259cbe45d03fe0a400fee6d65
SHA5127a331fa48003f1deb437585f4f3ea3c283157e7bf7f8608a9d1f14550def916d49150b58be985fb22277cf83a79f1bfdc9a3da91dbc8afcfd710c3c957c90949
-
Filesize
2KB
MD5b9178837f1762f419d61bf7887f65ef0
SHA1eb731dd960dd5a984b8a26c3d7ac26e7362aa497
SHA256a2be0ab5c8e09183af0d09a0b310074bfc42e3f8e910b045d2c857c95b9c83b4
SHA51279394bbb06aaa12130f48a8e03aa82083a35aaeb57c22629505f8123c08828d406d7347ba98a92cc6cff8b390e8e31f6642c83e28036b07f01e3b9992efabbbf
-
Filesize
799KB
MD5f382893c27a40d9578c3c0490c221630
SHA1f7c94af6bf0a501842a7e3d2fff0641f609b492f
SHA25609b6c705dca9ab54aa9a9d8a0d8822eb5f78be5e45193f2aca348af0cb129a90
SHA512f80384756757216b61d4b1f192f0da9db818c7f1c09cae6026966e47556360ec3b8283659c2ee01fa730c281302194cec3a71828c5b1df48f49052b80aafbaed
-
Filesize
516KB
MD526f3c0f259d9f612dafd70e82cb91069
SHA114285c2da152811f34e4fc6a7d2a5d4f5385cb00
SHA25608c3f6313779cf25931d326009610d96bbe668cfa1322770d042b701f5e6ab93
SHA512e749ddea33c2800f3e16476a354b835df26727d4b8875a59410ab5d1d734ae1f94d7ef6c1dc628247f4590b09a3b15e3020b30cf805ed00331cdbc2f9a327927
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
52KB
-
Filesize
296KB
-
Filesize
256KB
-
Filesize
12.3MB
-
Filesize
364KB
-
Filesize
1.4MB
-
Filesize
5.7MB
-
Filesize
20KB
-
Filesize
212KB
-
Filesize
1.1MB
-
Filesize
960KB
-
Filesize
572KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
348KB
-
Filesize
244KB
-
Filesize
20KB
-
Filesize
92KB
-
Filesize
84KB
-
Filesize
328KB
-
Filesize
100KB
-
Filesize
960KB
-
Filesize
48KB
-
Filesize
156KB
-
Filesize
112KB
-
Filesize
352KB
-
Filesize
316KB
-
Filesize
100KB
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
688KB
-
Filesize
284KB
-
Filesize
12.3MB
-
Filesize
348KB
-
Filesize
5.7MB
-
Filesize
1.4MB
-
Filesize
500KB
-
Filesize
5.7MB
-
Filesize
24KB
-
Filesize
212KB
-
Filesize
112KB
-
Filesize
156KB
-
Filesize
28KB
-
Filesize
316KB
-
Filesize
352KB
-
Filesize
52KB
-
Filesize
84KB
-
Filesize
328KB
-
Filesize
364KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
960KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
36KB
-
Filesize
688KB
-
Filesize
284KB
-
Filesize
4KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
296KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
1024KB
-
Filesize
128KB
