Analysis
-
max time kernel
157s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 09:40
General
-
Target
d5cb59fdd0eed8dd1391fc7d3fccd34a.exe
-
Size
6.1MB
-
MD5
d5cb59fdd0eed8dd1391fc7d3fccd34a
-
SHA1
59244144988dd83d0de0db464562b4e3ebc9b6e7
-
SHA256
e9b55ef2b2ed31a8fb742fe32cebce38a4a3d991b5028392b7d3bbef0e27a18f
-
SHA512
4fd2642f61a5a5058147943148871a04bcf528c5da91e313f19adfd3c4cc9e95cbde7408836dfb94267daca5ad504ea52b8eed5bb7907731bec5de9a4e45a9a2
-
SSDEEP
98304:21QTsHfgsazo2n9hpMU4M9cKbdY4YmdCQtjWdfnqKN0r4KQLwNYReF:6J4Bz1hoKbd6mgUazNieL5ReF
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 20 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5cb59fdd0eed8dd1391fc7d3fccd34a.exe"C:\Users\Admin\AppData\Local\Temp\d5cb59fdd0eed8dd1391fc7d3fccd34a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-L5A9M.tmp\d5cb59fdd0eed8dd1391fc7d3fccd34a.tmp"C:\Users\Admin\AppData\Local\Temp\is-L5A9M.tmp\d5cb59fdd0eed8dd1391fc7d3fccd34a.tmp" /SL5="$B003E,5657444,742400,C:\Users\Admin\AppData\Local\Temp\d5cb59fdd0eed8dd1391fc7d3fccd34a.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Very Toolbox\VeryToolboxLauncher.exe"C:\Program Files (x86)\Very Toolbox\VeryToolboxLauncher.exe" d5cb59fdd0eed8dd1391fc7d3fccd34a.exe3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.7MB
MD54c7fad60e590cdb5e0be9bbc5bfe0d63
SHA15af4e3e0b0f1cdc0873e659af4602f4b10d70fdf
SHA25664991ef3655d382c70cb0219d7b1dff1826c6546092690b636b45dc45e4884c8
SHA5122e620a54f8832d86f3732247f9240d83e2a77d8820d3ce2de5b66cd385cb6aed9417c0c393e5bc3ca5336ca95c4c3a8bea7459f4a9899fec49acd25db2993d76
-
Filesize
792KB
MD591f9cec42efc700661f58efe32fe12ea
SHA17adf680c6c32f602087759e1804ac087a3948de2
SHA2568bb298662b0c5001e110ea710451bd127ab204d68fbade95cd490b176098a8a4
SHA51285fe70f3c7387c2e78ea49b79b596e485ae33380016235165a1d1aeaedbd09394c96b0ab04a66a5e829899aec582524f8a4bdfc61266350223e8840c3edcc86a
-
Filesize
2.4MB
MD5a719a2e14b846d50a94c8b2f91f8a823
SHA189883c1e1855f6514094c88cd101fd0bacd9bf73
SHA256f51624ea2094f8271cd71c557d90a695a274c851260b6c919644ed4d93b2d176
SHA512a52fcda343f47175d15e2d2f454490be8badd7c17b462f5159823ed7ed5a6c8620d48bdcc2af76fb0cdbf2bb09888c4c8678f7f73fb384e32b9405e42037f68d
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
18.8MB
-
Filesize
780KB
-
Filesize
780KB