Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17/01/2024, 21:15
General
-
Target
639f5e93bcac941530352e0916880c19.exe
-
Size
2.2MB
-
MD5
639f5e93bcac941530352e0916880c19
-
SHA1
564e54f749ee1c08ff65c95f99d8fa2f277bfc31
-
SHA256
cc3d543e01f02408b76a2ffee482db5ce0e36b6a21ec1813dc32d89af99513b1
-
SHA512
3c502469e41a38b12dc308cdda48f44814b3f3422bdc20067e2a6486862719cf0322cf4f6bf13849392f1a14e8998000e9c557e1aaa3c240485279d54277b842
-
SSDEEP
49152:Lh+WjxRdLeF7E3hZ61ypomk2rWG5R4obiCedd/grhVU:LQWHdL2E3hE1y4295JiCu/Ah
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\639f5e93bcac941530352e0916880c19.exe"C:\Users\Admin\AppData\Local\Temp\639f5e93bcac941530352e0916880c19.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
12.0MB
-
Filesize
4KB
-
Filesize
12.0MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB
-
Filesize
12.0MB