Analysis
- max time kernel
147s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 09:23
General
- Target b863a9ac3bcdcde2fd7408944d5bf976.exe
- Size 646KB
- Sample240307-lcfevshb9t
- SHA256 0fe8e3cd44a89c15dec75ff2949bac1a96e1ea7e0040f74df3230569ac9e37b0
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 27 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b863a9ac3bcdcde2fd7408944d5bf976.exe"C:\Users\Admin\AppData\Local\Temp\b863a9ac3bcdcde2fd7408944d5bf976.exe"1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1444-0-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/1444-1-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/1444-2-0x0000000000B40000-0x0000000000B9A000-memory.dmp
memory/1444-3-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/1444-4-0x0000000002540000-0x0000000002541000-memory.dmp
memory/1444-5-0x0000000002530000-0x0000000002531000-memory.dmp
memory/1444-6-0x0000000002550000-0x0000000002551000-memory.dmp
memory/1444-7-0x0000000002510000-0x0000000002511000-memory.dmp
memory/1444-8-0x00000000024D0000-0x00000000024D1000-memory.dmp
memory/1444-9-0x0000000003360000-0x0000000003361000-memory.dmp
memory/1444-10-0x0000000003350000-0x0000000003353000-memory.dmp
memory/1444-11-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1444-12-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1444-13-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1444-14-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1444-15-0x0000000000570000-0x0000000000571000-memory.dmp
memory/1444-16-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/1444-17-0x0000000003370000-0x0000000003371000-memory.dmp
memory/1444-18-0x0000000002560000-0x0000000002561000-memory.dmp
memory/1444-19-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/1444-20-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/1444-22-0x0000000002610000-0x0000000002611000-memory.dmp
memory/1444-23-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1444-24-0x0000000002780000-0x0000000002781000-memory.dmp
memory/1444-25-0x0000000003500000-0x0000000003501000-memory.dmp
memory/1444-26-0x00000000034F0000-0x00000000034F1000-memory.dmp
memory/1444-27-0x0000000003520000-0x0000000003521000-memory.dmp
memory/1444-28-0x0000000003510000-0x0000000003511000-memory.dmp
memory/1444-29-0x0000000003540000-0x0000000003541000-memory.dmp
memory/1444-30-0x0000000003530000-0x0000000003531000-memory.dmp
memory/1444-31-0x0000000003560000-0x0000000003561000-memory.dmp
memory/1444-32-0x0000000003550000-0x0000000003551000-memory.dmp
memory/1444-33-0x0000000003580000-0x0000000003581000-memory.dmp
memory/1444-34-0x0000000003570000-0x0000000003571000-memory.dmp
memory/1444-35-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/1444-36-0x0000000003590000-0x0000000003591000-memory.dmp
memory/1444-37-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1444-38-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/1444-39-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/1444-40-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/1444-41-0x0000000003600000-0x0000000003601000-memory.dmp
memory/1444-43-0x00000000033B0000-0x00000000033B1000-memory.dmp
memory/1444-42-0x00000000035F0000-0x00000000035F1000-memory.dmp
memory/1444-44-0x0000000003620000-0x0000000003621000-memory.dmp
memory/1444-46-0x0000000003640000-0x0000000003641000-memory.dmp
memory/1444-45-0x0000000003610000-0x0000000003611000-memory.dmp
memory/1444-48-0x0000000003650000-0x0000000003651000-memory.dmp
memory/1444-47-0x0000000003630000-0x0000000003631000-memory.dmp
memory/1444-49-0x0000000003680000-0x0000000003681000-memory.dmp
memory/1444-50-0x0000000003670000-0x0000000003671000-memory.dmp
memory/1444-51-0x0000000003A00000-0x0000000003A01000-memory.dmp
memory/1444-52-0x0000000003A20000-0x0000000003A21000-memory.dmp
memory/1444-53-0x0000000003A50000-0x0000000003A51000-memory.dmp
memory/1444-55-0x0000000003A70000-0x0000000003A71000-memory.dmp
memory/1444-54-0x0000000003A80000-0x0000000003A81000-memory.dmp
memory/1444-56-0x0000000003AB0000-0x0000000003AB1000-memory.dmp
memory/1444-57-0x0000000003AA0000-0x0000000003AA1000-memory.dmp
memory/1444-58-0x0000000003AD0000-0x0000000003AD1000-memory.dmp
memory/1444-59-0x0000000003AC0000-0x0000000003AC1000-memory.dmp
memory/1444-60-0x0000000003AF0000-0x0000000003AF1000-memory.dmp
memory/1444-61-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
memory/1444-62-0x0000000003B10000-0x0000000003B11000-memory.dmp
memory/1444-63-0x0000000003B00000-0x0000000003B01000-memory.dmp
memory/1444-64-0x0000000003A90000-0x0000000003A91000-memory.dmp