Analysis
-
max time kernel
148s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/03/2024, 02:11
General
-
Target
4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe
-
Size
3.5MB
-
MD5
021ce3bb6c54febd1cf531e1e07ba08c
-
SHA1
079f83d244c90044699302daeec1165aff4b3280
-
SHA256
4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233
-
SHA512
37faf6d63f1eff641cb4daefe8d3cd96f2a8480d322ea7e1d7d08779e4095c45d054888bda3eb6a4e7b063787b70e527096a2ac4848ffe6fa4cf142e238be2e7
-
SSDEEP
49152:6dQ4omSYtiblkFLMYzIcE1x4MjjYp30g0KKpF1cER3iRHFdAQupummsDLlhySYJi:uQxmb+SpjxB0NpF6a37uuR0JxF5+F
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 37 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe"C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe"C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe" -gpipe \\.\pipe\PCommand97gmlhdifctjhdplh -gui2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe"C:\Users\Admin\AppData\Local\Temp\4c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233.exe" -cpipe \\.\pipe\PCommand96xguvgcoiwvjwwml -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\uqqtbnmlgqoceoxbsondgckusejeecn-elevate.exe"C:\ProgramData\Getscreen.me\uqqtbnmlgqoceoxbsondgckusejeecn-elevate.exe" -elevate \\.\pipe\elevateGS512uqqtbnmlgqoceoxbsondgckusejeecn1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
726B
MD5e1407acc4bc5429228b21d5ff69f6c4b
SHA1644396a7c87c1db7a9c540786f3086137a581193
SHA256000aad93b015fae8d93db6a21d5ad4568aff719c578db82415178a0c8eaa2b9f
SHA512d14b71bf50ea4726614e09c86efab12bf01098541f28a6a072beb717c1465429653cfa587b3172e99fb93124cdec10668a1c0ba9a70eba4a08e6004d79a306e9
-
Filesize
2KB
MD51af9d5122a6aeb870ef5b1a03809ae47
SHA1cb07350d68f27c9cf94b2d2d30ca9d74e9e60a8d
SHA256ecab88695b0257432e66214aa0fb4b05494a5bbabaa1703734b6575cc52c9bf1
SHA512cb9fe2fa6220fdf4b9438858b838b4aff172d86691a231dbed327c7bef6ce851134d711f17304ba7ae0523c3c893bbe7f6e0b31fa499bfbde68ec57140998406
-
Filesize
261B
MD5a46d86438d84e35ec64d0297efb47ce1
SHA17d75297ab6af7bdec776df1cb81a3a7ee096602d
SHA2562c1afab81564b2c24d20ca1c2b2553f0b18959e26e5b9d1e78c75e90e55468c3
SHA512da484a0475cc3c3d846dfd430c96d0f50b04b9b4bb7ce0a6b178ac38d16027c2ea01fa5b4ffe61d797ef9c3b783b57d6df10a8409a0204a5cee2163a87c93288
-
Filesize
16.0MB
MD5101aca71a5fc6af598fd222b4e42e0f3
SHA12e78790bae422cbd054cdf784927ad1780ca6456
SHA256a10f2a41cdf8e666028d7b6e8f2fcfd1d9dc45e49b35ac16f59e1f496168b68e
SHA5122fedcca5deb237617bd3cb3008d827b0f1530525b4782beb74ad32d0b37b22ad67b860a462013188022a4137cdc486972b36d9915c1f30101079df7312902f9e
-
Filesize
3.5MB
MD5021ce3bb6c54febd1cf531e1e07ba08c
SHA1079f83d244c90044699302daeec1165aff4b3280
SHA2564c8804f56b1507a064b51ece229e192613527d5c6077fcc930d53711e89f3233
SHA51237faf6d63f1eff641cb4daefe8d3cd96f2a8480d322ea7e1d7d08779e4095c45d054888bda3eb6a4e7b063787b70e527096a2ac4848ffe6fa4cf142e238be2e7
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB
-
Filesize
22.9MB