Resubmissions
13/04/2024, 10:00
240413-l1wfzsff9v 913/04/2024, 10:00
240413-l1v58acg25 713/04/2024, 10:00
240413-l1nq5scg23 813/04/2024, 09:59
240413-l1gylacf99 713/04/2024, 09:59
240413-l1gb3acf98 709/04/2024, 08:20
240409-j8er4aad99 809/04/2024, 08:20
240409-j8egbsad98 809/04/2024, 08:20
240409-j8dvssad97 1009/04/2024, 08:19
240409-j8cyhadg4s 1026/02/2024, 04:47
240226-feyrbsdb58 8Analysis
-
max time kernel
270s -
max time network
1205s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
-
submitted
09/04/2024, 08:20
General
-
Target
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe
-
Size
1.8MB
-
MD5
147f5f5bbc80b2ad753993e15f3f32c2
-
SHA1
16d73b4abeef12cf76414338901eb7bbef46775f
-
SHA256
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
-
SHA512
9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
-
SSDEEP
49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
Malware Config
Signatures
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:81⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2256,i,16750283575152780128,2524258836761969159,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD521112c87b4bb2b0bb8004c1f1653d36e
SHA131aed7e1843c4cc528931710ba578f909e71d764
SHA256556b87267249b63a0e4ab4e0afd7924e88f72e036c55c1e18c40c7889762449c
SHA512b95c5603d090c79c8e67bd8f6f5cedffd2d0c5b1d453489d99733997ff2722d83a138c925790ed4341d61756f859ff5523ef54674553b6602b730a7042eccb2f
-
Filesize
11.6MB
MD5fc19d5ee6587baa0b8e1e73e82334f7b
SHA15b1a1a66dbf1f84e2165e31984bf536bc586d2c6
SHA25634b6ee7351a3a3bcb8c3f4f7e9d5cd14e93fa1cf87da6fecb3e8732bd8e6ac1c
SHA512dcdeb434369cdd773a81cb030f7bd05d2ec39d6899869f1b0656e5c7a348d2b039317538cee86f355141bbf3efea723ac9f2161f20c56873e3ab3855e314d272
-
Filesize
1.8MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB