Resubmissions
13/04/2024, 10:00
240413-l1wfzsff9v 913/04/2024, 10:00
240413-l1v58acg25 713/04/2024, 10:00
240413-l1nq5scg23 813/04/2024, 09:59
240413-l1gylacf99 713/04/2024, 09:59
240413-l1gb3acf98 709/04/2024, 08:20
240409-j8er4aad99 809/04/2024, 08:20
240409-j8egbsad98 809/04/2024, 08:20
240409-j8dvssad97 1009/04/2024, 08:19
240409-j8cyhadg4s 1026/02/2024, 04:47
240226-feyrbsdb58 8Analysis
-
max time kernel
170s -
max time network
1204s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
09/04/2024, 08:20
General
-
Target
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe
-
Size
1.8MB
-
MD5
147f5f5bbc80b2ad753993e15f3f32c2
-
SHA1
16d73b4abeef12cf76414338901eb7bbef46775f
-
SHA256
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
-
SHA512
9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
-
SSDEEP
49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
Malware Config
Signatures
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD521112c87b4bb2b0bb8004c1f1653d36e
SHA131aed7e1843c4cc528931710ba578f909e71d764
SHA256556b87267249b63a0e4ab4e0afd7924e88f72e036c55c1e18c40c7889762449c
SHA512b95c5603d090c79c8e67bd8f6f5cedffd2d0c5b1d453489d99733997ff2722d83a138c925790ed4341d61756f859ff5523ef54674553b6602b730a7042eccb2f
-
Filesize
6.4MB
MD5d47b32f5fadb92c675ce98e70f6f7f1e
SHA1d1b532d9f849eda8f7b7f303a945c985f5cf6988
SHA256286c5392a5add00488282f9a262afc712be94a95615e4e7dfb0e27bca8c279bb
SHA51274d0f5cd309e0c72a09f27a8589f3a417d49b35c6b9ad7a65ab96e23fc8d03afd40bd42aef10c85811fb2dc1f337027af092cd43152464ce9b971051a0ef39a2
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
1.8MB
-
Filesize
1.7MB