Resubmissions
13/04/2024, 10:00
240413-l1wfzsff9v 913/04/2024, 10:00
240413-l1v58acg25 713/04/2024, 10:00
240413-l1nq5scg23 813/04/2024, 09:59
240413-l1gylacf99 713/04/2024, 09:59
240413-l1gb3acf98 709/04/2024, 08:20
240409-j8er4aad99 809/04/2024, 08:20
240409-j8egbsad98 809/04/2024, 08:20
240409-j8dvssad97 1009/04/2024, 08:19
240409-j8cyhadg4s 1026/02/2024, 04:47
240226-feyrbsdb58 8Analysis
-
max time kernel
1794s -
max time network
1803s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
13/04/2024, 10:00
General
-
Target
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe
-
Size
1.8MB
-
MD5
147f5f5bbc80b2ad753993e15f3f32c2
-
SHA1
16d73b4abeef12cf76414338901eb7bbef46775f
-
SHA256
40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990
-
SHA512
9c43aaa68161ef04c60e3f64c3fd54426dfd387f0013f009f3da94d45f19e514cd41de7b95865c47f55e5800222fd74736659138bb96406aa37f9cdc8e5799b6
-
SSDEEP
49152:L0F7w+ANy7moCOmY9x5VlLdf0w26/biK:IaXsCc9nmwfOK
Malware Config
Signatures
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"C:\Users\Admin\AppData\Local\Temp\40dc1ae099f2278650c0aa599ba00f659a87996208133d6a64b0cc5cbb5fe990.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3528 -s 109723⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5cae53678af8227e6d6f022d6a856ddbd
SHA1802d2d2a25e1483d5b47e9d1a7b6865d6938efe8
SHA256893db0cada5e10fc6ba14944a6eaeb435cb12fc4c17a52fe5c9dd02a04591ff1
SHA512c4a6c660d11da9484f5bdfaaec4f5316b98fb84259f8f4f624b762a4f1f0cd4728291e9f1f39e6b9a26782ccf3d10003a8c210e29e06f4a48316243a227bd04a
-
Filesize
6.0MB
MD57f5dd106bada20b0883d08071ebe9218
SHA169228fb0292f08790db2b041e9966bd22d8a8737
SHA256e893fe794f3fa120f2f9350e89e166a6764c1726ec712748593fdeeb4df5800a
SHA512eca5bf8b94fbf0f64f6b82a1459bce92261ce7294748365cc8ff28624b61c9ed16887b0ad135642288217d5f114a263eb741e94e38d9cc7d1c594f026071aad6
-
Filesize
1.8MB
-
Filesize
1.7MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
4.3MB