Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 09:35

General

  • Target

    0fccd268e52746248a634b08b86929331605b31e62d88c239afd72b4f8546798.exe

  • Size

    316KB

  • MD5

    a21dfecebfb3bc499f805c71a6584f2b

  • SHA1

    b10c6128b84357f2b2ed2d4779a162ce3e508f24

  • SHA256

    0fccd268e52746248a634b08b86929331605b31e62d88c239afd72b4f8546798

  • SHA512

    3ab082a7b6977760821a17ac5e54ac8bf1b2edc169d9b701d480de4cdeb050185010b5805d178a3119108fbf105aa2828d377657ed341fc266476363666513d8

  • SSDEEP

    6144:/qqDLus/zSMn2Oq2Kz2222UHj0HIT3e2hQ5r9zMyaImi2uI:iqnuRz+3JugVpi2uI

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0fccd268e52746248a634b08b86929331605b31e62d88c239afd72b4f8546798.exe
    "C:\Users\Admin\AppData\Local\Temp\0fccd268e52746248a634b08b86929331605b31e62d88c239afd72b4f8546798.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
        PID:1680

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2516-0-0x00000000022A0000-0x000000000231B000-memory.dmp

      Filesize

      492KB

    • memory/2516-1-0x0000000077B22000-0x0000000077B23000-memory.dmp

      Filesize

      4KB

    • memory/2516-3-0x00000000022A0000-0x000000000231B000-memory.dmp

      Filesize

      492KB