aed5ce71d4dff26c4b257c3a309d5dd2a16950b9ea01da7d2d85a64fd26bdcc1

Analysis

max time kernel
92s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CABANAS.exe
Size

7KB
MD5

dfae6328b864a214da7d0f6ecbeeb011
SHA1

de4c4fb9515cb2c6797a22ab3743b8e24673e24b
SHA256

64f3313cf9c8c08f5cb57ea10ac8811267d82b5092dda97922e8def41bcf7e15
SHA512

74be42a78232905b2957d5f4c82ccb08a4b59b232fc09b59f5e0d1ef3b693976083675ff242236e2b4f35602f439475dee7263b2d4dd1bed81d915306e63e5d4
SSDEEP

96:nPY7wfXcfG7tFPyrfMICynmCt9iZMVZCTwo:nbXVFPyr0INSato

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\schtasks.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\SearchProtocolHost.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\WerFault.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\comp.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\rekeywiz.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\RmClient.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\ROUTE.EXE	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\where.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\wscadminui.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\wsmprovhost.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\appidtel.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\cleanmgr.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\nslookup.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\wiaacmgr.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\Windows.WARP.JITService.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\sdchange.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\SyncHost.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\tar.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\dialer.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\DWWIN.EXE	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\help.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\NetCfgNotifyObjectHost.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\diskperf.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\net1.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\fltMC.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\raserver.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\dcomcnfg.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\extrac32.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\OpenWith.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\pcaui.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\replace.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\tasklist.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\tracerpt.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\edpnotify.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\fontview.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\verifiergui.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\find.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\CertEnrollCtrl.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\choice.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\ComputerDefaults.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\ftp.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\mobsync.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\msdt.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\OneDriveSetup.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\fc.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\InputSwitchToastHandler.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\isoburn.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\w32tm.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\InfDefaultInstall.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\net.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\odbcad32.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\runas.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\UserAccountControlSettings.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\iscsicpl.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\SearchIndexer.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\systeminfo.exe	CABANAS.exe
File opened for modification	C:\Windows\SysWOW64\msiexec.exe	CABANAS.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winhlp32.exe	CABANAS.exe

C:\Users\Admin\AppData\Local\Temp\CABANAS.exe
"C:\Users\Admin\AppData\Local\Temp\CABANAS.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4060-0-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads