Analysis
-
max time kernel
117s -
max time network
137s -
platform
windows11-21h2_x64 -
resource
win11-20231222-en -
resource tags
-
submitted
18/01/2024, 09:38
General
-
Target
Core-Temp-setup-v1.18.1.0.exe
-
Size
1.2MB
-
MD5
176642114ee7a82e0486bf5fac5777c0
-
SHA1
f4329a1afc37f143ba1d39d9670ca4b1acd61c23
-
SHA256
ca7d1365e934b3bd122ab8b0dbd24ef5e0c52471cfca15921555fc6b244e9ab6
-
SHA512
dab12f11066bad3dcb2d6dfe599cdeab135ec8a69ba42fe157bf887c2c9ffea5615ac3661f5e011fb0ebf396930c9be84b1ee7987056189d0457f7a053a7a5dd
-
SSDEEP
24576:686STfiCBXodcnZ+EshXP0QoZI0HGLeA8X2x/Us6oqK91BoQ9uZUR+zZdBq:oKBT+T0DA8XtnSpV9u1y
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 42 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe"C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AGO39.tmp\Core-Temp-setup-v1.18.1.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-AGO39.tmp\Core-Temp-setup-v1.18.1.0.tmp" /SL5="$80242,868100,121344,C:\Users\Admin\AppData\Local\Temp\Core-Temp-setup-v1.18.1.0.exe"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Core Temp\Core Temp.exe"C:\Program Files\Core Temp\Core Temp.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txt3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD52d2d1bbb48de5fa2c0f3640d7d6080ca
SHA1074f357f87de6dfa339c961b3142f2175c8ca59d
SHA256f9001dcb685394c8f68aed151be65ca5dc969c59b85fc407bb159d22ffaad1cf
SHA51216ede6824debc7fc20f7894c0ffb3fbee389eea7c43cb1896810ac7f2ee880ad7dd6ea0940901b0000b240feb9aee1c606f8758bb85df7b98be5273f4aae5d2d
-
Filesize
1015KB
MD5005727aa95c9f4899ea7673b114d91de
SHA1ad96a46fe68428dc293db99b53a0593b6bc1d786
SHA25626259a6f290a799eeb1c7c9b311e528c77e458582f9396d4dfc1c69dd2ad6891
SHA5129e0dbb00b37e957114b7d74663600e041cad88d1940f4f3489e7eb7c347e51e8ede97ef054f5614f32facb5c6364b724a7781fb9047f190614718e8325952577
-
Filesize
1KB
MD594b56e0809f8b30af3aaae2a68f498b3
SHA1a37a100fe91c0d9731f325994778d7c7c033451c
SHA25623f972f8ab3952b2f891a41bd2d151d97016ca7bc9c78df30b1ab376211c66ec
SHA51299f7142431b98bb09eb57db3437c0fa0ee75817de9c24eb294ce53ff1cd526d96ddf8c3d12d8ed524d9676cc90098c7565004468d205e9cd0d06aaa52c748ca0
-
Filesize
3KB
MD59ab877751224d96448876f7ecf15559f
SHA159c910d91a64b2eee54997dc3fc54d8905b7748d
SHA256abb84cf36bd0e8f39248f5477ca0d427da9b7e3c10b6666254b98d6e06b40e7b
SHA5125c0684c21d7bb5500f9a1ed44b73b4e48755e5c7eaeebb8fa369a5fd6df2b21db127a76199598b3061a997919a7917116004190f6f0f7bceb5590e0a82baee78
-
Filesize
65KB
MD52c69729bafe1f9b6e5fa4bbceb157f97
SHA1ff791ae19d440fa365f2635716b96a942e5f5782
SHA2569aa957b6815486b0009cd72244c06de6adb0c6a4435ba17502855bfa210cf319
SHA512c83309f2e7c0db8a59a07e37af328d4c6c33092ecf0bc0b96272c35c35be11ed09848076765540525a821b3e39d927d520dbb4b2643789680c8fe51c979229ed
-
Filesize
62KB
MD54ea78fdd1efd2d4756bc1e4f16b3df00
SHA1e9b3f53b3d74a2e6706a431fad6dc2b07d5f627d
SHA256b88748db05e055d523562dafc6a8782b15dd95da433efb159f92f13d4127d708
SHA5123f24fe7240aa8f342ec5e9b243aaa54d238a65e90cabf77374a0508d5f0f06df61f5ed166b8e650f3d7f50e4a0a4b5628207acc423ab29b6f643fbe207d82a46
-
Filesize
59KB
MD5cab3c7daecf34248c80265d8110362a2
SHA1b52b21d26a68c21aac97dfca365eaa67392e6369
SHA25659cc53c555fe7e63ba8829cd028829dc8dd74427992925c1e19e86e20207331b
SHA512c3bf1881ab3e186e99cfb473866fb1b7ee6b219bcbc0a39f2a6a592d955e46e519cd105be969157c2604d16f6fe75dc69dbed88139c0c594c74dfe135999f471
-
Filesize
57KB
MD5617a5febd1666ca193f4f1a9d68141c3
SHA1b893999e8d1b88f2f615cb0017b924f13f81e128
SHA2561c2ef08100e6abe030648aa79481a09daa116fa2c2576ca6fec8bea859fbc978
SHA512f5ec669ce67d15c1c45409cf75b88b7b7beb4facde1aaf7708ee899c995a68300388e6a8fec89a3e25d3bc09aaf7defaace987ff52093109e8f1741c5ec9daa7
-
Filesize
59KB
MD57563e869c466ba7d5a8b75b48267322e
SHA18d75e2a2bd91a2ddcb16b31595015dd4492c8b49
SHA256924210d96c7867b71cb04a7f5284cf9fcd94d9565e1499e7897d0fbf720dae8b
SHA51258df69aaa9649b1afaaa4cf56ccba34ff94eedcb4618481fa5b167fd61334c56004651e167328c51c0d4f0dc28222a638409b43b73d31889f9d6b9cfdd9de908
-
Filesize
59KB
MD53a269829635417f5ae88244dd8d5bb14
SHA12b825fca659cdd00ed26f47417b7cc2983f5d058
SHA25631a47838210cc82be048bebab3e54dba5b4e8c5c359ff0cfe897bf5d984c98c0
SHA512b626dd1602f26e96112c64d19aac9e0e3dc91e25cfc517edb6e8dd76d6fd99b80a9b302c4c17604c0407446f6b93d54adda20aee9010213af7194357147aabe2
-
Filesize
59KB
MD5a8ca7718fa6fbe5fc648d30f4fedd84e
SHA1a0f0c823b8f3d0a3b0c6acc281b771935ada682f
SHA256f008fd3f6edb7176af0b1773432cb2b00376a2214e6d3773b74945e085a613ba
SHA512821824efe40dff8a44b467f7cc88e2e1bf14cf419105cb57b34ffd9aabc765b7747544eeee3d61812f78772cee7d43de6e0858cbc04fe79173269e8dba0bd7d9
-
Filesize
61KB
MD5a95708dc56b605135cede20d99078f1f
SHA148d34f861b1323bbb417dbf456e82de18cd18dae
SHA256d3e9aa222e15ed3973dbce4edfec1c9ecb0bd1f4549e8f365d5e2875d65f361c
SHA512334f32ef9e54b9b15a314ac73ec9fd66246269dedf08973412ed45df87deb1c4c38b7af1b83a0b8a6bf1ef04a1e0b1db007227c023fd355bb91d1d8eb3688c53
-
Filesize
55KB
MD5bcf124b526e4b4203cae6c98e2574638
SHA1bcfa0d6fa258bdcbbd388ed61532634a15745dbc
SHA256972d614176b257307d3f7880b13a87dd008c4ad2919e2bed7844b5be7cf739e3
SHA5120b81fb54797b7bdbe4cb2514e6b106ef11a9c04a13a239fcb0d2867a6961db3e6d3cb8cd1dfe3d95778c2eef9668d616480fda770ac35953c6567dca8c741a5c
-
Filesize
55KB
MD5191cbade2b2755787cb9b5a430890ff9
SHA13b8223de36bb8de2c0b83b71aa84f0dbe0a99e64
SHA256baea52a53534507d59ff2035ec6dfecd848730f249c3f3510ef693d97426a344
SHA512b862c987b2f71d323f868491f4cfb0c94262e4ead6462a45952c32599c79f4c80b3ce74f0de6b0d2939c72b93366947b55d4435bc86ca0f948a6beed4c93f61c
-
Filesize
60KB
MD58c7f0944ab3e1c982a0fb4395d8e9291
SHA1e40c93b2f5dd6aeefaace9dc630a32d78b7b9da3
SHA25635d852b22a1862dda1dd9c52c4c37296503bf22464a5072aa8b432536c6ef7b5
SHA5128ba08e80bf507acb53cb3ff76300e4645ae827f1b4a80a292425a55e0d9c7cb33bd64dcbbf061ae100dde4a9f759c261a28d9b21efcb9d4465ea5a8e3f5031fa
-
Filesize
55KB
MD50c0ef5add396f3b5321ea3c65f3fdc50
SHA197eccfcd7f4c4181b3d59feee6f0bb81a04919f8
SHA2563ae3d77a47977912c408b53464a259042d75edfea8f4b1cc972a603733bfeb78
SHA51204c6c760af3608c258eb7a8c09fc8aa97030fa3c0dfa949c43b550498031bb4d6137cf3774b08be1fcb097c1dd0efbfbcc4a858e91a83f56f27cefbe455995b8
-
Filesize
61KB
MD5fdc4c49980dc53902f683ca9a0796838
SHA1d186024583a22fff7b44cf4e4fdae29867ea7bd9
SHA2567139ec8266c0da1a6e0fb2b18161df2770835b86ae5f0b7d523545b3843688b8
SHA51219a8b1450144f9cb0151a91685e214a4c52d4e283eb2cb8eaa48b7f48c9d740ca6422f759029c0c612c80ce983e79b8a869723ca47a4c711b9fd18fe08e0b5f1
-
Filesize
56KB
MD5971ef942a32a5f8a1b62add491c700b7
SHA11c3a9e240330d4f339c4d275e00d77c1705ae370
SHA2563c0bd9d33030bd4a5f2ef096fee272ca16bb244f4480b70325d77bcbf233b7b4
SHA51282a0e4725a14f2b7c44d177297e406a7dfa8b49dbc69cb9076115e756421b2203156467d87b9c4afa5e34fdd037a477248dc68baac5abdf1676c57603ff84d30
-
Filesize
64KB
MD5eb7b1e45da3e0b1b5e6fa91c20dda834
SHA1ad42f6763d22230112585c92dae3053bbf020bff
SHA256a718deb7fc0c386c186fcc81c76d134718031168974fc40c91f75cb4c4429193
SHA51291bc3e2a4aaf4a057cccf94f33f3249b712a7c1d75b2009d555e36b0046568b91f623352a046eb1f2eeaa9e3918ed542a8f2cf20cfc1a85ea0fce7429d0a9b16
-
Filesize
60KB
MD5d2e85cb2c30a251a72cd4657e82b3434
SHA105bb2cb025697711d9aef3d528d224b9158b931a
SHA2568932042d67d55eacd551aaa9cd1514f4f203baa0dc3fee3239d2a5cbf23f7e7c
SHA512d8e896fc744114c38dc84c164df4c5f00676e6bb5e7e0285f145bc4d75cedb7db99dba21120c84acd3b728f43a1f097ef43d43e6e935fabbbc6e801c7168cbf5
-
Filesize
61KB
MD57d2a854a537f8e5f5a8bc339aa67db51
SHA1dabbe8f43af0d2a7ad6133751e1e20db16d184da
SHA256f1d3bc7cd6c4cd2205ad29410fc96e2aaf90eea6d419ce4453c5ac8ee48ef533
SHA5129095e07347aab09b16ea24e8479241c597d1eb12d57d36b7030dd55aa678a35261e668635f4a31bcb5330dd67f1900e99113524067f699109ba2e95c76aa1835
-
Filesize
56KB
MD583ccba724619e5c9a56a23828b5b89b8
SHA1f30050a569184bcc108360ff5fbf4e61362bd2c6
SHA256e2203f06201ebaaeb4d1567c827f3efc6c196124e22ca547fb17b556539175c5
SHA5126c9eb9382fed3893c037b13fbfab0bb94595081adf1fc2140129950b7b7518b94473608d6aa39d4faeee40d8dc66a53b0dc8ddc065995b32cca69f03bbfe7500
-
Filesize
59KB
MD50c2fc99cdaad52b8d1e8e518820b2fff
SHA1dce9a3ad34e243bcf6d7340920f8bf361e1c6e29
SHA256c69d8e89b554df3c1a80957203a22d8851c793bb63c319f523fcb13af45a96b2
SHA512fad15583a98484e37a79fc3a7fe29f502a818dd6a0a552a1e9fdaa72b294852d97269defbdb1f4e3ca4bd29fce7e21a8ba90e7c8e62d54ae8f45d2aa0a3cbc18
-
Filesize
55KB
MD52a0fc6907d39aba6a4766f1a91aff61b
SHA109ca147b021785646b762eb7b7b224e04844a821
SHA256834176043b4d4c91db3355a234c8e8e7e8b4bc501fe73711368c701ae09c4df8
SHA512ebf316817aa3c63ff015361c74f3e26e2298d6d3e76aee33967db0654f3d5c71a699a263d9ba484f7eb15f276b43e8eed43a6c9bfc7bf91497a75beb4929d796
-
Filesize
56KB
MD554ec0764410281d9ead7483aad3f3945
SHA1d8efb7cdc8584cf729c2e25e704deefca2320f8c
SHA256b36118ce45ffcb8f802c2bd65d649ee3b99bb02fdef93c745dc90433b2baff19
SHA512b4617a2c0ace631b3fc5eae9eb18b41727a9cd75c2c9f636b4b612d5059e759ebbba45a6058d8fff60ef849066bcfcaaa35d40d0902f1c7c6dd3dd4340bbf85a
-
Filesize
57KB
MD59e194c70fc83faf01bf66cbe7460d42a
SHA1a8b49b8db9de2981f4020d5f94321cee849121f4
SHA256e9a5a6c4e59f8fbc2451a1daecabac2c290ed9c63018ee5d16be36170790dca9
SHA512d2fb48c32e58354e68270b01dcaddf3a4f3c35adc1bfbd1d5e82903328cb1e4fb929ef1eeb799a71c5704dda3286e9dac32c3be76fcec5d7b9d9ab70665f2820
-
Filesize
60KB
MD5e3689c41a6f337d16f88da6325fcc4bb
SHA1c0a4ee62e361f43945c4bd0b9f115c9967e49817
SHA256afe27513f791b5789761e5a558bc2b0b6f415276cad0c98bab36b51b03a9f4bc
SHA512688e6ee6de3475f08eac4065fc9e137ec4d6ecbfc76518466f0079cf19204e7315f9cdf9fe1d6a1017457ce18d5eee4d813ec8401f02b0c3101f49af703036eb
-
Filesize
64KB
MD5a22e740a377745072638f9f6e7874164
SHA193e28d184ba451c0643fef57f4d9ffb725a9410d
SHA256fc3a37a6d9a94144ede99f64fcfd5091a9e033f2576d95e58fde68d8b2add0b5
SHA5122a3cb0e7c9a34669f37157d2849edb40f82374515aa29afc4db9e153e6d3a5af635a6f692d9d92aa4f51e10cb591474ab41f828e6dcae724532ad45cdf4117f4
-
Filesize
55KB
MD53329b73840afa7ec15c7aecedb4c1dd7
SHA15c6f30cb15ddbdab05ee624b364e2ee89c4ecca0
SHA256bd3e96c215803b01a63655dd9a8237feef52978bab073fc6b6185b03ba4b2208
SHA512d4547ffa623d8b1226292487a002b184fa604979bb473e65dab59b48a332607fdf1fd1d1d13efe6ebd9965f5ab53502bfd9b045b18470225bc30c47666e6d5ee
-
Filesize
53KB
MD5f83f997db4bc3f386c61afafa223131a
SHA1ede0e01954ea6c9b349ef41f8f5304f627198fb3
SHA2560d6c0840a403503bebe283a46c455992cabc946d1b69cc4917121cdde1a35d1d
SHA512afb7727078a89cfb98d983a7f2d33e960c1f27d85da926eefdb5a12395a3f691182bb096c1ca96c1a706670306ab2774186b83d965977e029925c08aac731153
-
Filesize
55KB
MD512662e24c25cd9eeeeed82d0efe6bbe0
SHA10b9b556cd50bc5a700e3ab17334bf7e160d54347
SHA2568f92c5734e564569426435c07c423da1094f78989b16be6260e58e1c5d235d0d
SHA512f440ca9d24f91f7411279f9f9f023e788ad53d779240f0e4fe223ab932dfe8d60ea474e6e423a7ab4b88d23f209b986e56596b5a33eeb262195fd7cccf219f0e
-
Filesize
64KB
MD5b44a7f8cbea4d2cf3ac4008b3181ab01
SHA10aa801762ac8caeab5c86f6398e78aefa390088c
SHA25603b659de4a1c1694844b84ac9af8e4460404c0103baebb56c2d9d70d14ed9f99
SHA5124e0fe28873f3f1a6dfb93518be8f17c9160676caa0bb4185b3e8e6f5a36abd0f42297d006eaebe1f6fed83567af316a61dad7055acc1f9e33eb5fe3cd46a0e8e
-
Filesize
57KB
MD5e9bda33af535e76333e334bf856c1680
SHA1ccc59ddbf4e1ddfdc7964e1a60dc7759cd33a249
SHA2564a092fd512ff5458ed8ffbc3254b984e74fad18e4385b13eb7b014dd555d4d9f
SHA512dd12f6dbf30dd9fd3630fb29db1b73bf847723dc1028558c12cb455ef2c2dd127fd5ada2e55f7553f684447c1dd25ec899e1b70b24829d0d1a94e05f35bb8c8a
-
Filesize
54KB
MD504e14dbb22547daac571f1c7a9be5de0
SHA19960c71f99d3ccf5ba784af89a3a1b7c52faa7d2
SHA256c8b0a0810182cd25db6032a25b11b844dcfc595dbd802db4102094aaf819f3d3
SHA5127a13058febc20abd9d2c909e35ef613ccef4948f5a1d1b789b1f515acc32c5946f91bc83849dcca51f7a2cf43e2e419e93f08b028ab952e8b04e10de24d41925
-
Filesize
58KB
MD50082104443a08c2f4d7d7f702fa0042e
SHA1516410ffd507832bcefa775f77cb1aee1dd6d94e
SHA256359680f8c73dbade8249a46c9c8a818567821b9267332de66445f365f493698f
SHA51255f247d2cade8d7770fc24f8dd5b920cb47a669d7dfba0eff6967b5e80e372df20c4d642d4197170dbd4e118e8dfbd2b883750bf82421f2057d0168ae550c39c
-
Filesize
42KB
MD5d9aafc513be1c4c57b9f9827e986039c
SHA12c688a6e881d35df958cb8ff2e2bd8e21b8461bc
SHA2567a20ca8f9361eb892257b3693095ffeee61457dc4e22d9b119e3a9f3a1507069
SHA512200a3df1ad0a18f5547e2f595f412f96d76040fa16de4720f76b305178a2bf9c944d31b5928dc2333d99a72fd617762e87885aa7e56719ccba2e7e593450f6fd
-
Filesize
959KB
MD5b46f25026215958a214ab95ba6b913de
SHA1159cfb135861621f39d69050a99343e702a9a41f
SHA256824baffac9002b41008c26b9f225d74fed0869e723ee792bc57f818d42005afc
SHA512592499be4c23c41208189e25dc17282c7ec68a5308ed13f4b5675ecb96438e59757a011acd194dd1b08bafdcf71bd2e0a88bddd82671fd8d8982e9a0bab72daf
-
Filesize
16.7MB
-
Filesize
208KB
-
Filesize
2.7MB
-
Filesize
992KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB