Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
09-03-2024 21:04
General
-
Target
1828cf00ac9d39a664c31f850db6dba62e18beae146bdef9152d83fb67767c41.exe
-
Size
135KB
-
MD5
aa727e23681f4a6e1126507a33b6ac08
-
SHA1
c94bdc24a035b7525462af82821d8af716f18414
-
SHA256
1828cf00ac9d39a664c31f850db6dba62e18beae146bdef9152d83fb67767c41
-
SHA512
a32861bd780f5bfcf61396e01732cf9ad2f1f585452d3974835f6e112ebd797a04bd7b628c9314e28b2761b10e761c87121c81d5cbd69e07d7b09eab6a954362
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbV69:UVqoCl/YgjxEufVU0TbTyDDals9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1828cf00ac9d39a664c31f850db6dba62e18beae146bdef9152d83fb67767c41.exe"C:\Users\Admin\AppData\Local\Temp\1828cf00ac9d39a664c31f850db6dba62e18beae146bdef9152d83fb67767c41.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5cc9af44c1104cf1736f834e3f2d8b8df
SHA19f2012a85b52675139cc7f90fa9d3c90a80ab26a
SHA2569090f1715abe8188a32de45cf0773e69f3f2d715f61aba6fcce1961b02adbf52
SHA5126adcef5d629cec3e33cf99bcec07d5ac5a04b2d8c881be4a5fa60e1179bb368bf06aee8d680060107a19ead37f74213cc96c7b1a119317ee034f84d40868941d
-
Filesize
135KB
MD57a17d87c9fe75ca00b9fcb6262107a9d
SHA1bf2ca731b1f09b49db1d05ac474a03ea1337778d
SHA2561ff185094bec66f80164e1680631066b4f03589f9d9d98b593b0b1aaf631e635
SHA512ccb8e079d63c847e6cb0a6e933fcde93ac87f60abad95dc6ff78d09fb4b406670322c58722878653bab0671283b066c696c986f255685317a4c0ea3b31e7a02e
-
Filesize
135KB
MD535f2895c76d9758b8a524002b58cfe0c
SHA1055dd48e6da6a5b89f25a75bfa84ccd5dd03bf4d
SHA25607a07bf5d5ad7840fbd0aa4923b8a12d8d8b176b55b287283a5e186bcc286e47
SHA51277951f390f310e3b70a1c3e70acf7d38ff3f6f34ec35f3b33604523e1f1ba2283306fc617f8a65ba766c85abe4cc3993b8e8698c707854eb644d1459b86e2882
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB