Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb18e98977da54b4d41bc871104d4b59.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb18e98977da54b4d41bc871104d4b59.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
cb18e98977da54b4d41bc871104d4b59.exe
-
Size
4.8MB
-
MD5
cb18e98977da54b4d41bc871104d4b59
-
SHA1
1a8935b62898ca9109d310cd4535e9a8f1b3e671
-
SHA256
68bc0f2b4a4545d718f310dc59d6a8220d6b967aafc4617fa27222f4ae153e44
-
SHA512
813fbefa5bb8889f0d2bc60f15f4135cdb727493a013cfe4f712b282d90aeacdc4d52593ee0086fc9f1955c6b38c835dfd2a605753f3b9755aece1918b5e84e8
-
SSDEEP
98304:QyyDODsUMFd2Ts5Wfe2wwSxIVQKf4ZfrfRRO4Gbrm/UW9cg39WcdlXBdDg0375PU:Qu4JfgSp9xqw3DNWa9nf75x9j5+b5WQ
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Arquivos de programas\\update.IE.exe" cb18e98977da54b4d41bc871104d4b59.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\windows\Gbuster.txt cb18e98977da54b4d41bc871104d4b59.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe 3048 cb18e98977da54b4d41bc871104d4b59.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 cb18e98977da54b4d41bc871104d4b59.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb18e98977da54b4d41bc871104d4b59.exe"C:\Users\Admin\AppData\Local\Temp\cb18e98977da54b4d41bc871104d4b59.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3048