Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 03:29

General

  • Target

    85ce21f3dc8f10a0366bc670d42bbd67.exe

  • Size

    26KB

  • MD5

    85ce21f3dc8f10a0366bc670d42bbd67

  • SHA1

    bd825287d79b3cb80756bcc3994143336a4aded7

  • SHA256

    75ef989e2ae793212683181054955442bba047f350eb3e3b073155780688a16b

  • SHA512

    96438d84b7745d719cadcdda629a6e9527cee80aa9839515939d016757a369b3c0012ee6aabb3c075e3278fefa12f98e110da769ce764f1b2b643ace131ada7d

  • SSDEEP

    384:IyYk+GmqMCe1szkdQ8a5/EY+0OdAJO0lv1xBqIWUNVYzBSl2qMsv:Im+5qLe1szk+dEYU81X/4BSlSsv

Score
8/10

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85ce21f3dc8f10a0366bc670d42bbd67.exe
    "C:\Users\Admin\AppData\Local\Temp\85ce21f3dc8f10a0366bc670d42bbd67.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\hws.exe
      C:\Windows\hws.exe
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      • Suspicious behavior: EnumeratesProcesses
      PID:1544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\hws.exe

    Filesize

    26KB

    MD5

    85ce21f3dc8f10a0366bc670d42bbd67

    SHA1

    bd825287d79b3cb80756bcc3994143336a4aded7

    SHA256

    75ef989e2ae793212683181054955442bba047f350eb3e3b073155780688a16b

    SHA512

    96438d84b7745d719cadcdda629a6e9527cee80aa9839515939d016757a369b3c0012ee6aabb3c075e3278fefa12f98e110da769ce764f1b2b643ace131ada7d

  • memory/1544-5-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/1544-16-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB

  • memory/3412-4-0x0000000000400000-0x000000000040D000-memory.dmp

    Filesize

    52KB