Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
30/04/2024, 21:40
General
-
Target
sdfsdffsd (1).exe
-
Size
142KB
-
MD5
fda69a5cd4d6e64f5b85aceca25ad3b1
-
SHA1
964bfe6d01de6552f68f611e6c1069a7d688439f
-
SHA256
c4545587a690fca9877079f5a52d57a81aac09b1a412fa8e1fed82a43df4763d
-
SHA512
eceabaff3ac0d88077dc34835811d883c36236ef8afd229075e07748ae0e74d1909829d58a927ef23dc8a3e473fa61081d5b9233b4ebb34c9b38f18dd7ef7c55
-
SSDEEP
3072:Aw7sWPXuD4wi/P1o8OoY90fE6HDN8eVZd1D4ifeeXS9IcevJewSc6:AEsyXuUwwHY94EIp8eVTl1feem7I6c
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\sdfsdffsd (1).exe"C:\Users\Admin\AppData\Local\Temp\sdfsdffsd (1).exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XenoManager\sdfsdffsd (1).exe"C:\Users\Admin\AppData\Local\Temp\XenoManager\sdfsdffsd (1).exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "discord" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9E34.tmp" /F3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
142KB
MD5fda69a5cd4d6e64f5b85aceca25ad3b1
SHA1964bfe6d01de6552f68f611e6c1069a7d688439f
SHA256c4545587a690fca9877079f5a52d57a81aac09b1a412fa8e1fed82a43df4763d
SHA512eceabaff3ac0d88077dc34835811d883c36236ef8afd229075e07748ae0e74d1909829d58a927ef23dc8a3e473fa61081d5b9233b4ebb34c9b38f18dd7ef7c55
-
Filesize
1KB
MD56037733991864983c723a5343db4281a
SHA1327c26d7897c3c778f2418a165b5499d2ea3c580
SHA25608e04b7014e75878ab49b5b722a2570982f87182175260e64173012849827566
SHA5123aca85683ffe5fecda3d2af4764f0d494d617c688da80b9a049d39573dd216f97950b1139876c69d34c695d9944413a4d9adc8b89b2a622b7c9faf387ed1aadf
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
7.7MB
-
Filesize
224KB
-
Filesize
168KB
-
Filesize
7.7MB