Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09/03/2024, 22:24
General
-
Target
5760cf56bac53815edc00d7f1d95e668bc5249c8f48eb910f51e41590346d589.exe
-
Size
464KB
-
MD5
548e82654a3523914d02f5348c77c9e3
-
SHA1
66e256fe259cf2ce4150a6edb7aaf554829cc5a8
-
SHA256
5760cf56bac53815edc00d7f1d95e668bc5249c8f48eb910f51e41590346d589
-
SHA512
fe18655baa6632da2f032e32b354cf0f63f46cd31569598d30fb153d369d2dcf0f1e5a0cd5ed1d40fd6566c71f62a2f327cf07a578739583b2d9a658f0dfa94b
-
SSDEEP
12288:CKlc87eqqV5e+wBV6O+O//GsPGWpYzzPz9w/qzB:CKSqqHeVBx//WWm3Pz9wizB
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\5760cf56bac53815edc00d7f1d95e668bc5249c8f48eb910f51e41590346d589.exe"C:\Users\Admin\AppData\Local\Temp\5760cf56bac53815edc00d7f1d95e668bc5249c8f48eb910f51e41590346d589.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dxdi_ssp\Bytecomp.exe"C:\Users\Admin\AppData\Roaming\dxdi_ssp"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~35D5.tmp3388 475144 4680 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\convdpSa.exeC:\Windows\SysWOW64\convdpSa.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
464KB
MD56bce8616421fcd57e294e7bbc3b8d4aa
SHA1b3bca4f8ee4b183001e20e49149f3a991edffa01
SHA25639927533524e6fba901b050c2628a17517919486ad7c873b067d07d688185d9a
SHA5120e85f9d8896fbce6719baefd8c196e656bd4bb0c2f61a876c3b4dc6c0f46cc91c679ea54c09e8194ae0df6491710ccf7af1ad7d9c713da1232a70dc4692e4f34
-
Filesize
52KB
-
Filesize
528KB
-
Filesize
528KB
-
Filesize
24KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
488KB
-
Filesize
500KB
-
Filesize
20KB
-
Filesize
488KB