5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe
Size

1.1MB
MD5

74c1f21a36b42fef34d17f5d815ea228
SHA1

8047f890b3cad6b394d353a5fb44754825fb23a4
SHA256

5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982
SHA512

5c405a95865aa4b593a85330552f8b5657ccc74db576dbc9fc3aadee958acbfec6ac1363b47faf2c297c3161cda4a304580f93241def8d07499248eba3f03cda
SSDEEP

24576:d4lavt0LkLL9IMixoEgeahdJHHcfNpLpbtxMQGq9MmCS:0kwkn9IMHeahdJHHcfHLpbo/aPCS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4900	5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe
4900	5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4900	5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe
4900	5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe

C:\Users\Admin\AppData\Local\Temp\5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe
"C:\Users\Admin\AppData\Local\Temp\5ae8fb475b2811eabc157e5cc99571b9e6702c1b69d028a03bfa16806f77b982.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aut3544.tmp

Filesize
262KB

MD5
5206a1099a524ad5dd71f930e146cc70

SHA1
de80a285d8a23590d0a8ea5b44e9dad82ad4f217

SHA256
a1c67b40e0841c65188381d6cfa2e15f10754c17ccb8505b2167132a2e7f88cb

SHA512
d01f12218bb83e751a40b086bd58c98cb02df22c2269f87837382034ce18bca4bc998235c46af0173eca7bf5849f63c6ffacad636d1a469618b795bd385c18d9

Download Submit
memory/4900-12-0x0000000003400000-0x0000000003404000-memory.dmp

Filesize
16KB

Download