Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
19/05/2024, 23:13
General
-
Target
720b1b84d84a3db109045395cfc4fa73ed69ae08aad4017f93c189fc5744edc7.exe
-
Size
135KB
-
MD5
17f0cdb95b66d02b3367560cb1f8d566
-
SHA1
a439e14a54806d76b66bd706449ffa5745e9dd72
-
SHA256
720b1b84d84a3db109045395cfc4fa73ed69ae08aad4017f93c189fc5744edc7
-
SHA512
ff2134abe47219f0f249ffb956aa9fc939308dc826e0c2e03e411617e4d26d65bc9905b37e0c798b9278aae1a158f6ff4bc32d5e724b68d2f4bb7b6012aa09ef
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVhpal5:UVqoCl/YgjxEufVU0TbTyDDalQl5
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\720b1b84d84a3db109045395cfc4fa73ed69ae08aad4017f93c189fc5744edc7.exe"C:\Users\Admin\AppData\Local\Temp\720b1b84d84a3db109045395cfc4fa73ed69ae08aad4017f93c189fc5744edc7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5cbae96688f7f72d6a6a2d63bb3222d0a
SHA1a69f9abc0699ba41ac600dfcc706b3f75bcd7a2d
SHA256eee93ed405ccfb4b6b9dd44aa4c6c080b15e6e9e3028b00296bfabe18d1a2d61
SHA51252feaf802ad1e627a110dfe81d1c31a54254c31adbe81274be84a2202fba7bc5e036651b801d10686706ebdecf83c34149196d94e441a9053d19351a4bb73fda
-
Filesize
135KB
MD54345084eb4472a06ece45e23a19fa16a
SHA118d5322b8b8220e86f357f2acb52cfc7f4bd3c1f
SHA256dc573c0363d96b37130b9fda124023a5b2dcc46283fe98444c4114b08de06382
SHA512142e667abd4f4eae014392e2cf3ae4ae41ad2e9c8975a472563f98ce1d55353f6351fb29ef9b4512a6ac50119e3eb3fa932488588cfae5850e79e4645610699c
-
Filesize
135KB
MD5f643add8ef3af049e5ecd8ac2ac70ca3
SHA11f9be7cf2c2b36a38da96b4e342b3b4de3c86b79
SHA256fc055cdce6d741a5d63bd3001256e595b77975f35526d4ae3c135178deef82b5
SHA512e15ff2d953025e493cc1fefa0472b46c497a1bc5e1af47790d331ca699100537594455d848a2cb14f5e6c904b38f28bd9227a86c7e774024a12a4ab199fd9af2
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB