Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01/02/2024, 05:47
General
-
Target
8616f6a3ef9c203c5f3401fff16607a9.exe
-
Size
12.3MB
-
MD5
8616f6a3ef9c203c5f3401fff16607a9
-
SHA1
fe3ee4441295b5cb7cc006673755f42d713fbeb1
-
SHA256
cb3efa4f3d8225697cab092ecabba18353ac24b874bef80e705a1d1dd48e3f52
-
SHA512
ddc5ae041eaea91f7b60e9d5ee95499aba34c9d0151cec2cb4b665833ba79214c1b3d2102c8d7d078906be362ab0b81f099f0618d8f0caeb80dbdbae315c2799
-
SSDEEP
393216:EG1J86L+1mbeRq7DEac3cdiG6VvRq7DEac3cn:R1J88ZUt3ksQUt3Q
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8616f6a3ef9c203c5f3401fff16607a9.exe"C:\Users\Admin\AppData\Local\Temp\8616f6a3ef9c203c5f3401fff16607a9.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-Q5VAI.tmp\8616f6a3ef9c203c5f3401fff16607a9.tmp"C:\Users\Admin\AppData\Local\Temp\is-Q5VAI.tmp\8616f6a3ef9c203c5f3401fff16607a9.tmp" /SL5="$70120,12177326,721408,C:\Users\Admin\AppData\Local\Temp\8616f6a3ef9c203c5f3401fff16607a9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\ShadowMaker\experience.exe"C:\Program Files (x86)\ShadowMaker\experience.exe" 8616f6a3ef9c203c5f3401fff16607a9.exe3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD57030ff1087d00289e5dfed1021c986b2
SHA12def6aa37cf853934268aff0f2566f636a552321
SHA256137670c7649484cb9efcb4b0bd91ecf43e8d3734dbd9f0a0787f674e55905f7d
SHA51281787de066c2400412af96d822263f3555e57191f6e6abed5990c4eef4d6007f67aff87c19b7603ebf9bb08e8941fb13285193a5b30a7c0c8a6fefd71387b330
-
Filesize
752KB
MD53db917d8d9720b54a4c868a35805315e
SHA1f64c0bdde46e9126edc2b1f19978ff64d298ca89
SHA25686d8d7a2b130c1b827d2e0ac50df14466d72e65d8621f5f9e124a2617d390deb
SHA512e835be0e9c63b386bb0d59b301273e6cdce19dbe175b0050f42faf3ccfd8c04ab624a6203d8b2035606a58a05b669c67037b6f9dcaaa118021bbb3911b9d6200
-
Filesize
881KB
MD5cc742c4ae8240c1d2b36caec81eec115
SHA10cd57c0e96b7909a1c3c504417722f0df263ee95
SHA2564834b7b4cd7466f78290ee62940e8b5488eead357b1a5346aecf15c1d29c968c
SHA512ec9c731cc5ab31a462bbb70e23e445f411540a3935d59625ab8bae4c1bcf3f27817d835f7527a27d867871419903a0983462c8afb756b3d9f3e53b0cbb0dacd5
-
Filesize
23KB
MD577d6d961f71a8c558513bed6fd0ad6f1
SHA1122bb9ed6704b72250e4e31b5d5fc2f0476c4b6a
SHA2565da7c8d33d3b7db46277012d92875c0b850c8abf1eb3c8c9c5b9532089a0bcf0
SHA512b0921e2442b4cdec8cc479ba3751a01c0646a4804e2f4a5d5632fa2dbf54cc45d4cccffa4d5b522d42afc2f6a622e07882ed7e663c8462333b082e82503f335a
-
Filesize
2.4MB
MD5d9b6cc86734de734dac4d44ea322bd98
SHA1261bdd9e9fda40b7a34f213c0d44b9e4d401c811
SHA256fbaf958bb45bd9b3bc1072066516ed89491a52233edbbfc53c0a67ccbef75578
SHA51282947131d5823e035e01d09912097ea58ae52afa2b44166a3fef2131a53ecadfedde21d3c2ec688d87ffc40bf31bdd9ff12fe23e16d4ecd44ade9a08cf220dc5
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
19.1MB
-
Filesize
19.1MB
-
Filesize
760KB
-
Filesize
760KB