Analysis
-
max time kernel
140s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
25/01/2024, 02:05
General
-
Target
73732658650643a02049bd439e649d23.exe
-
Size
6.2MB
-
MD5
73732658650643a02049bd439e649d23
-
SHA1
0053e7fd273f2e4c12dac95eedffa0f79a36b052
-
SHA256
96ec2b2507de0bd5269ed6336214982170a1cace9e0ff1607b6aeb4fb5e8fe1b
-
SHA512
d84d7469dc854146b7833d2e87919286062b6e41fbad5d269fdef278b943be496bc07f805be02f8d08037c08b579c0ebd8bd04d285fd10060272c2212e90e277
-
SSDEEP
98304:XHqPmH+R2r4fFtmocc/v21KsSXLzOh69CBkvZcUf1aphMoRdKuIXBbvCwc:3qOeRrQlc/AV6uh69CBhQ1ghVRd8lCN
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 24 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73732658650643a02049bd439e649d23.exe"C:\Users\Admin\AppData\Local\Temp\73732658650643a02049bd439e649d23.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD59eda6ac05d976773bec1a5ac2fc19c3b
SHA15885ea8e22e1d85b30e5e899c2f803c0212edccc
SHA25647cc32f966ed28e1bd719faa6ce6d2919c4d447ef784b866155796ebb410ae0a
SHA51221401d8c5336832d3603e596564065e20f178ec8cf5a983b232cdea97f1b5b55a6d3cfe141262e3680aa2caae8bcf9ec41d1db07e3d3edc243a7c308461975a9
-
Filesize
99KB
MD5f2f4d5d1202dac692495b1d9353db9ed
SHA1ca8f6da6262afc85a7556568b64ec622efe67eb7
SHA25633043da2e3e2eb61593c765466809a20c4ce367eb696ce0cd4a71ca43a2b0a38
SHA512a0dae7f757ad75d603931dffdbb97d1bc7a0eb4872c40edaba9ff2f2809e7db8506edc212dd72536cab1bb8adbfb31f9641a5710b17e118a9d19fefe8152d850
-
Filesize
152KB
MD519da7945c15a24dcebb394e94abd0708
SHA1cdb55d9c3f3edc02a5d74ad44392fb95d81b2491
SHA256b1239d0f0dc212748ffb1071b4aa985d2f0fded795e44a73198b5545aeee17cc
SHA512a143ffc6c9b4dd2640dcf710b201854247302baff552c05283163f9d222846d6d55a37811604c030b807115e95acb538b70e31db2261a7104b2817ac3ff99b73
-
Filesize
132KB
MD53a9fff286cf967cfd251324c83bf4921
SHA1e0c90a51520ef36803469f3de79039db01cf49b9
SHA256bed9643898f91e7bcc4d551ceff435c02d71867cc5a950b0de53489e26cb2155
SHA512e772539f8f830d89797bd187dc07f1a66aea5aebcb7e8e2c569c8d53bcd19bb7deaf95c059c49c4d71dde8fdea07f0108e954b4cd966635881dc3e47bc62f4f0
-
Filesize
108KB
MD5b37958cc63ed36059b97f4e325882ffc
SHA11053fcd06c16b730e869656b04d5c43deb21492e
SHA256dea032ebf9b47349a378efef8d6abf97f3e9e4176e13c802524910b9cbb77a9b
SHA5125a7e0200f316316e0d8370b91f5063f1f774c7ba11730b65dc104c49dd0791d5103bc8f4c798fb541d2d4235c30323a3337cb34c2756fa86c641eee46b3427d8
-
Filesize
194KB
MD51fc866bef186aee39a075d39e333d852
SHA1931d402a06e13a6af53e57f54e8b577aacb3c6ae
SHA25681c6d90d733ab9bbe07b2514cd5ae2447be78a7c36e7a8d6f7fb6f9903d12093
SHA512d9f279373031a8f8d2c3dc4be4528227f2ed2219daea8c60920e8a408b07cc804715c4b90df937a406f064552dbe281727afaf36bbe64aa69dadbe3c81f7b8ff
-
Filesize
135KB
MD5af5a5d7e6fefc31dae5c34c3e025b0f7
SHA1021225e6aaf381312a895c18a7526706a127c846
SHA2561e7146acf18acdfb2a204bc4daf1ae9788edb5a652575ca9061af81b6938799a
SHA5128e801ef08e2673807e04107a8d32befae1ba5d686af5022830c071448671d614a0a638141abad26247e5f4a9fb8c40c38fa703cc116358a3309225e433061fda
-
Filesize
211KB
MD5a955381c5c5416d48d76dc3deeb86e56
SHA1d56d6faa34b51dd2622ccdfcaf0d88c18efc7e4d
SHA256fbdf6dbebdc085e984958cf76db61265111669c5b0a978bb714d5e8de617be72
SHA51264445ed96d6857a3b0e4c4375fbcb02beb321e15e358eee44c0e51716950ad3a1eb47882b064aa7d1421b416d8f0aaf222e5e6e621bca2dc3fab582188bba12c
-
Filesize
149KB
MD5754d8a3509a82c0e4c5b581553637bf4
SHA1984ba7f672a527c9cec6f39404628a3b8f6e134b
SHA2565e893ac5ba50dc2d96364d9ad3413e550b7966cf95d7411546dec2e6c749f705
SHA512efe795ba0c79bbb0c8a09a82e0421c4f7c6f47e5e49df39dec19b62656030557b6d41099d697359eb84fc9274b61d810bedfb0752a652303c12e71ac6a1ef7d5
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
1024KB
-
Filesize
260KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
1024KB