Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
02/05/2024, 05:15
General
-
Target
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe
-
Size
135KB
-
MD5
27580e16d98942bd17c7fc15ee21b3b3
-
SHA1
fb1f6eb6aa320f19bbbaf053c8f5a8c361ef589b
-
SHA256
ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5
-
SHA512
46609d708a3e23642307206ad933e68c535273541cb6decb11bb7a9baf11a67cc7ebaa2444f4854c37e546a679593cca1332e4f5babd6394af2a913d4ab64be3
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVK2:UVqoCl/YgjxEufVU0TbTyDDal82
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe"C:\Users\Admin\AppData\Local\Temp\ee2fd8cfd4cf2626509b165bd26eaccb406f8336ae23146bc231677f601b70f5.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5e482f1d363e92d0efa0414751308fb46
SHA1bdffcc2116184ca9116a8fe9006c10b9181392bf
SHA256fdf66f56a91fe04f4becf1f858f597cec591ce3e6643eae9ce3744c40d58f8e7
SHA5121a8dfd1842d61620dd1fec611a402a63e26af583693d63c54d827b04c207718cd672afc6b71bce1ab719fe71942ffd67d914522691d9465acb66baf2128149c5
-
Filesize
135KB
MD57f7dc4ab34e0d65734fd4aff0f659d3a
SHA1213d921ff3cb4618bc09331035d6a4e1bcbe30dd
SHA25639df95b06cd52ba4c91c7abf3bce9e3e4c0a90766437b673eca381d644d8b1b6
SHA5120f5da521b638acf3c3e3335b401151893baad02781fa02ae85ffd797c83b0136fd63a593dd60bf60250b590a3dc880380910c3e4e919a5be98646849f60af40b
-
Filesize
135KB
MD51e64e87737c38e882876b95964624fa2
SHA1b4882e5afa2dd7cc0d6d6eeabab850d480516980
SHA25679c3100ab8e2b5775098db5f643c4b7930199aab7388675b7102433252ae6bdb
SHA512fe9ad4e39034a30603847350acd5d66e1e77bb593bbe87f0d4da7c0de6a5e167a659e317a7ac915d5d1922c4435699c0857bff50a593aba930236217ef53f1df
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB