Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20/05/2024, 02:27
General
-
Target
d6cedd61d575e9193f85648f68aeaa2414e0a5710b659a5894f9c6107c7c0bd5.exe
-
Size
79KB
-
MD5
e72cd49ad0842e4f3ac030999d5ca1cc
-
SHA1
77d57b2dd8e87fd7b9de6f8209f257989c91c48c
-
SHA256
d6cedd61d575e9193f85648f68aeaa2414e0a5710b659a5894f9c6107c7c0bd5
-
SHA512
d5b96ec68b674adce6bb6735fde59d756bb4d3e562f71f8870b6cc28db8028e7008e3ae583b1e6fb87fed1087fa23d52a91f11e9998691963459c9ee28aca2c5
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOx/c9:GhfxHNIreQm+Hia/c9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6cedd61d575e9193f85648f68aeaa2414e0a5710b659a5894f9c6107c7c0bd5.exe"C:\Users\Admin\AppData\Local\Temp\d6cedd61d575e9193f85648f68aeaa2414e0a5710b659a5894f9c6107c7c0bd5.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5dab344dc75b8e8a830d62fd10ff6daa2
SHA15f6fa3f2511845e3aaaa322b190dbc246c91f0d5
SHA256fb28d7be55f56ddaf08c5f0afd04a6ad72b0b1e9f0c47144041b379233400456
SHA51216ce7b0db46a360799cb34e24bee17c0107ed6530e32a0e66c334fc0325efe6c955187c9643914610a883c69c251f9ebd7914131f1855a062b6024c6fc8e34b5
-
Filesize
77KB
MD5189f5f873e5fa29c5598daf0b52f1b06
SHA139d331f047e25f8385a5dfc91c187403287ac063
SHA25685ce4811cf60c4f37fd8b62586ae0af1d3b0fbb095bbfda73c12f4fcc7726fdb
SHA5127eab9329c9762241e425118e3d8d01379336bc070a83f5f34c2c45331eb4b90435e9a1e421740a532f52f4e25efa217bcb135a4554493e6b1f44c59fee0568f7
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB