Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09-05-2024 16:30
General
-
Target
09052024_1630_1.exe
-
Size
378KB
-
MD5
3be9e476da2e99adbc49591cbc94b4d9
-
SHA1
2155590f685d4e28c278123a1cca633e8746db78
-
SHA256
240677752d6ba09cc9f98275d694c500ed75808080fd6f8d750c16a526dc4ba7
-
SHA512
604fe5635f17fb7294436f56436a43314c9c3d29c335acbf4c9af21bfe86c958bf88e2e1863d329136b49ad612a70bca656bac9f351ca8b1332ad9283c4dcc88
-
SSDEEP
6144:Bh+z/269PFlPUafH7j2e0Ulu92uONg99U/45bXpJAJ1/x7Ly55r4UsQnW3:Bh+L269PTzuelu982PU/45qFFy55cwn
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09052024_1630_1.exe"C:\Users\Admin\AppData\Local\Temp\09052024_1630_1.exe"1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Custom_update\Update_4a0e654e.exe"C:\Users\Admin\AppData\Roaming\Custom_update\Update_4a0e654e.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
378KB
MD53be9e476da2e99adbc49591cbc94b4d9
SHA12155590f685d4e28c278123a1cca633e8746db78
SHA256240677752d6ba09cc9f98275d694c500ed75808080fd6f8d750c16a526dc4ba7
SHA512604fe5635f17fb7294436f56436a43314c9c3d29c335acbf4c9af21bfe86c958bf88e2e1863d329136b49ad612a70bca656bac9f351ca8b1332ad9283c4dcc88
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
132KB
-
Filesize
80KB
-
Filesize
404KB