Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
15-05-2024 04:06
General
-
Target
e0ce06ba7cbb986c611208e4ceb69c8fa2a785b9dcb572cafdf377a4d6e3b658.exe
-
Size
64KB
-
MD5
548bf9609260f39464e76d217a17e227
-
SHA1
2a3bc7885c2a5d41377e4d08724b8d3739e730e4
-
SHA256
e0ce06ba7cbb986c611208e4ceb69c8fa2a785b9dcb572cafdf377a4d6e3b658
-
SHA512
945413f5e0760107164b662124bd3c8427d2d53f8949d5ed0a1b2bdb5c333b87590218c038c013e4d134500667dd9f9d80dc23ed4a059a54de450d420190b882
-
SSDEEP
384:ObLwOs8AHsc4HMPwhKQLroh4/CFsrdHWMZw:Ovw981xvhKQLroh4/wQpWMZw
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 33 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ce06ba7cbb986c611208e4ceb69c8fa2a785b9dcb572cafdf377a4d6e3b658.exe"C:\Users\Admin\AppData\Local\Temp\e0ce06ba7cbb986c611208e4ceb69c8fa2a785b9dcb572cafdf377a4d6e3b658.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{838B2C3E-62F1-4952-826F-F5DA723A59BA}.exeC:\Windows\{838B2C3E-62F1-4952-826F-F5DA723A59BA}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBD194A6-1A9E-4343-9065-23C9614FFFEC}.exeC:\Windows\{BBD194A6-1A9E-4343-9065-23C9614FFFEC}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B5499A5-A4F1-42f1-B05F-8C2C5B6ACED9}.exeC:\Windows\{4B5499A5-A4F1-42f1-B05F-8C2C5B6ACED9}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{855BAD9C-AB18-443e-8AF9-34B3E5A2F2F1}.exeC:\Windows\{855BAD9C-AB18-443e-8AF9-34B3E5A2F2F1}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32855B52-83AF-4cdb-B2C6-8503DB751876}.exeC:\Windows\{32855B52-83AF-4cdb-B2C6-8503DB751876}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37DA57E4-51B7-462e-8466-8BD6253A4D36}.exeC:\Windows\{37DA57E4-51B7-462e-8466-8BD6253A4D36}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C2AE832E-D5D7-4eb8-A41F-3CC984A9D18F}.exeC:\Windows\{C2AE832E-D5D7-4eb8-A41F-3CC984A9D18F}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C200AFC5-B0AC-43ae-B956-E06191FED2D3}.exeC:\Windows\{C200AFC5-B0AC-43ae-B956-E06191FED2D3}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8019245E-110F-4307-A7AB-E2827156FFF4}.exeC:\Windows\{8019245E-110F-4307-A7AB-E2827156FFF4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB30BBFD-8540-4d43-BA2E-F29E95A73EAA}.exeC:\Windows\{AB30BBFD-8540-4d43-BA2E-F29E95A73EAA}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44DDA118-08B8-4af5-B284-0D57D6DB0D82}.exeC:\Windows\{44DDA118-08B8-4af5-B284-0D57D6DB0D82}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C59EA4A1-C70E-488c-ACD1-54CB4BBF72D6}.exeC:\Windows\{C59EA4A1-C70E-488c-ACD1-54CB4BBF72D6}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44DDA~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB30B~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80192~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C200A~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C2AE8~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37DA5~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32855~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{855BA~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B549~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBD19~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{838B2~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\E0CE06~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5edb7ed5bcb02333779347211f0eafd63
SHA15813463e6763961a002b28c2960895f45173c43e
SHA2568051ffc1163e0ceeb8160fb6b7c510bf97df35b46952cb5d5fbabc5b0fafcc74
SHA5127d06cc96055dd524ebf5c5d895d58c22832127f50025cd1855f9358ec1d9c844aa33b626d9c642058e7ffa6334a385f05964c48246e1b1fef71d28a4df98b4bf
-
Filesize
64KB
MD5848adef60f22fd9ce8f3255fdb5f8dfd
SHA1b68363940df1a4fd78022e5034bccf3656654972
SHA25607b7389af758149f1052ce727858a8a558c0cc44e212f135ed4abb6953db8122
SHA512cebf1f646512e32ca6b601779207b371df8f7704d27ed46636137939720a50d676d4fc4351d457bbe15061aa5a786d18b7b862d139ed40edfb9b514386a98973
-
Filesize
64KB
MD5a56e142991a8321064a866de52a7bace
SHA128e26af6d8c483f9a10e0ab460581fe9ac3d7c78
SHA25628a20a5b1de3c4b6e2b35c90d3a255a0b4a3ca06b8ab81b9640b86eb8b8e4457
SHA51235780e27e439fff12566ce0530ba49eb5e64ebbe252f8e16d6764b1e20e24ccbbdef8b84df01b342999ab498dc4681343fbd28c8154f74521dd61fe658672734
-
Filesize
64KB
MD5d0d9d67726da449b658fef149decf97a
SHA18f2cc1802a4af521fa08b760f6b720643a21310c
SHA256cee8b67cf8787622a50b49cc2f06b330bd782b50583cee5b3fae60a3d1928876
SHA512d4e42096e81e6b720802be84ca818761e39dcb537476343bb1b39c4151925f05709c037e88381eb183887f8f72e81feb66527f889d5e5e3f62a0a0727983c1d8
-
Filesize
64KB
MD59849c04980a90789b40300572ae29f1f
SHA1eec32d20357e0787d4f700e7cf7f4590c38eb230
SHA25600a39642b259aab91766c01376b5d9c214c4645a60168e8e88fdc35198ffaf08
SHA512b5180ee98f8d2291f95e4280b9f4c5aaa487e789cd34fe37307063a18dd796a92401e073afb2c608856c40867190683cec6e4e8661521addb6c0b4ee26aaf651
-
Filesize
64KB
MD5f54bfda948dcc0234f71a5c2a2cfc30f
SHA14d8ff40bf1f4baa8baad3ffa70d98e8674cde805
SHA256520637956478cd66c29600f203522f73737de0c38acdb09a1e56b90608dc9602
SHA512c9b6ad8ba9ae4d442e15617ce1057ce2e3b4f4cc5bc753a8c92d8085cfe5da90a6d6d8ca405059fe045a27ece6beffd45567797b121bdaddb888bcbbdb5378d8
-
Filesize
64KB
MD5977764e4c0d65bddf999a40a80295c3a
SHA1ac46c830e2e784d53e75d62e8cd3da8aada92a5d
SHA256bddac76bd43a5d623a0870946301e7254734f9a35e30b2f61901fc17915bec16
SHA5129c61559bb6bf8e42aa62a7cf09285fa3e1843b1b1847fd64948b306b0d80d76f4ec61f7d97d0b798aa2951ed2466cf5dd43d68cf04dd1108ed6f2e1ae5e4dc89
-
Filesize
64KB
MD574fc800ce4ed7186f19ff39889ee06c9
SHA12eb64f5d8d40470773c6b004f5a7c5b8c74ed8c1
SHA2568482043db6e23e3f3c03058080cd430a082138845cee30f905c97ccda0a1df88
SHA5126ab592403231873aa3196af9ccf54d085da92de9361276418f2e69f7e79ef61268fcf77cb70633e433de3538f45e7af324ed9c6f8dea4624267f6f1614ced9b0
-
Filesize
64KB
MD51fa4a7737f3e053a591c3b8966addec4
SHA188eceddf7f260ba7838308e2164730a5ad677f17
SHA256c3472070b108ffc7b1dd6988378f891c1c7f0fbbd0afb483533c046de9d0dc90
SHA512eb2ca36196249b9d061e94bfec68a7b7e590ffdd214548c0d1d72b6d5937c1d25c9e7b9257453fba646ba8172f179272b4d4ff034ceb62736a650c458e9b7e51
-
Filesize
64KB
MD520f3bd5edee1a0d051c87c30067459fc
SHA1a6aa8d26591ca4f14500aacc49170d1a5ef24f37
SHA2560900c6b936a40a7caaa62df78d729ec4467d81d4263d0355333168618daf76a1
SHA512a37107c2e1608a21f964670031a25ec7e28d3c9c4eae54662227c5c30016767f2533cc80d3362c1bb9abb23f59d95ba0d2be73205146125bc5f831dff27b5668
-
Filesize
64KB
MD5ebc4d0299bb91cba6b05512bf416040a
SHA1096664b87d2cac4aba418ccee821670203f4a6e4
SHA256bea211b9f232807c138660a3edb405b4ea3755ce8014581bab049ae2b96e6e63
SHA512695e7ea8219613168ec09cf4a77eeafd90e031cfe6cd5ec2908786d3bc817446fe09cb83d9aafb502f63bf04299cea49b28eb58faab2619007d60a51006614be
-
Filesize
64KB
MD5f6ca9577a4923be50dce90410b149a17
SHA1d1854a7408813addbd1d1011c7820e21b5696579
SHA256283fec319ea7fefd58cbf2fb7d5031ef68caa8b25c266b2b2e299da539ee96a6
SHA512aeb7ea7f92384052ac887776ba0c6550dc87ef393b8a6e6ea8bc029380276d52a831166bf4bf445a803d7335c67c7526112548c1ca7ea39a2e826a719742ad5a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB