Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 02:29
General
-
Target
c23a1c61c016b93168071e76881ba134.exe
-
Size
45KB
-
MD5
c23a1c61c016b93168071e76881ba134
-
SHA1
723ea342dc6e28cdeeb18020738e4198cb39533b
-
SHA256
709f4d63aaaaa4071dbb5f74ea9ef1292d78a55d773b4f0c6efd1ee9c6c5e9e1
-
SHA512
7e3f5918a75ec44bc2eea959c2e136f8002d2ad96b96001b25381922122f8be6f45431de47adb29ca452d04ddfc941d6f9f3b328a29ab1eff841950efb1fa262
-
SSDEEP
384:Qhu//BkfGN15yrdjI+cRy2APBsLf45kSyf8K7MPZv9Tnf/eC/Gv3nUt4lJtNSvzw:BBkeNeXdt5ADCnfP/lt8teQNLIoKpo
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
jaguar666
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23a1c61c016b93168071e76881ba134.exe"C:\Users\Admin\AppData\Local\Temp\c23a1c61c016b93168071e76881ba134.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB