Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 02:39

General

  • Target

    5a0f6ca33a29b18b530ae30b2a7e9b97.exe

  • Size

    24KB

  • MD5

    5a0f6ca33a29b18b530ae30b2a7e9b97

  • SHA1

    3b4e8982627749baa2549fdffc7df92ca29541a6

  • SHA256

    d1563306e5a17b4ec58086b75732cde95f43a7f8a36985584edb09f706f5db2d

  • SHA512

    abf456ea74cd5b423300eaf4c0eb4196dc8c880c5a037bd84652f6905ebdc9bdf0b3ffbb8eb532d90e54f99996f236447889bc5348069b0fbf2d34c909e46a5b

  • SSDEEP

    384:E3eVES+/xwGkRKJgtDvlM61qmTTMVF9/q5C0:bGS+ZfbJAvO8qYoAD

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a0f6ca33a29b18b530ae30b2a7e9b97.exe
    "C:\Users\Admin\AppData\Local\Temp\5a0f6ca33a29b18b530ae30b2a7e9b97.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4168
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ver >c:\windows\temp\flash.log & cmd /c set >>c:\windows\temp\flash.log & ipconfig /all >>c:\windows\temp\flash.log & tasklist >>c:\windows\temp\flash.log & net start>>c:\windows\temp\flash.log & netstat -an >>c:\windows\temp\flash.log
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3484
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c set
        3⤵
          PID:800
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          3⤵
          • Gathers network information
          PID:664
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:3004
        • C:\Windows\SysWOW64\net.exe
          net start
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5732
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start
            4⤵
              PID:4772
          • C:\Windows\SysWOW64\NETSTAT.EXE
            netstat -an
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1064

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \??\c:\windows\temp\flash.log

        Filesize

        14KB

        MD5

        e0fedec2b422773bdf467ab6101276ed

        SHA1

        f5f647d945242c2d42648e3e9647917dab4c195f

        SHA256

        70476f4ed53602d3de12b42ef24785143787a28a25d913e47384c83f2233dd47

        SHA512

        bb1986988bd2a3673279ffd3ca3d7f9458a05bcfb97133ea21486da84f4a6ab2ac9f0202d1d3d62221bb1e1dba89d506d3457b685ce1b2b6d9b46010bd977447