Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
07/03/2024, 23:49
General
-
Target
bcdc33e3abb923706f104085c46f6c72b6917c677b966003a5163e847b732ec7.exe
-
Size
135KB
-
MD5
1e0ee1f883b737358b779734a99007f3
-
SHA1
dceab1a01b2c6aaf5232d7bcbad56e75d2ae89f2
-
SHA256
bcdc33e3abb923706f104085c46f6c72b6917c677b966003a5163e847b732ec7
-
SHA512
ab6d5f24dae7e942f49c5f61e3c27ca6a0e1291007fc80fa4b116cafba0783d39963e84050ac661d63161c8ada049769636217da1163acda2cca197e949ae5a3
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVCME:UVqoCl/YgjxEufVU0TbTyDDal3E
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcdc33e3abb923706f104085c46f6c72b6917c677b966003a5163e847b732ec7.exe"C:\Users\Admin\AppData\Local\Temp\bcdc33e3abb923706f104085c46f6c72b6917c677b966003a5163e847b732ec7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5374b3c50ce6df6d532baffce8e7a494d
SHA161c8e5f74d14f6041e64c81807e6b7ea5847204a
SHA256445cc2ead2bafc2e53068d27981d1c3d1de21bc02bce089e281436897d1d887b
SHA512bb6b43a789ed8bdea5fa14186ea37876cb58a6976922d65a747c74a769b7ebb1f15c2139c3a15d58b86dab24875047d4283829dd17768d0fe47795ebb2aaeefd
-
Filesize
135KB
MD55e2b00453b541f5d887c6c58ba168139
SHA10d031e5d4c6bcb7641589de14156260a8440bf05
SHA256ed12f66e097b549674b779874c284de862b3f43e0627caaebdf0e2f444555abd
SHA512f01ea2c91fddb3a5c1bebcb1bf60aa635862486b65feb9cb2c786f3f64c2ce5c60569c5144c3cffa5e13fa4e8ae3ee3b3905bb8f14eabe556f1358da3bffe06a
-
Filesize
135KB
MD5af250912f26c866b3f356bd56e59b05e
SHA104f7a6ab27dda418b9892ecaf963ae51726dd3a9
SHA256c5530b2fdc4c57575c33f0098ed7cdfa3279a932d3b9f4ad50875954ef3f2b42
SHA5124b52b841d0a4ee7f950b5264988a6e584d466669c8ecb79748c67fe62d6fdfb19e1946ef43d8a612cbcd1b9bb18e1aa75f58efe92a0114072cbd672f71288a9e
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB