Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 19:28
General
-
Target
07480c35f06a32660604bcf480a8324bc0a7884efec7873b15358af0023be09a.exe
-
Size
64KB
-
MD5
02985d25bd794c2b97a604b3607ede70
-
SHA1
87e91e18cea9c9edd41c5aca1664902d4ff11e0d
-
SHA256
07480c35f06a32660604bcf480a8324bc0a7884efec7873b15358af0023be09a
-
SHA512
b7dcefc5693ed1b0701a8ca6e9ccc9d0769f17c12b464aa878fd00fc2802eef0a8905cf9a62bd4e4fa74fc7dff72714ece386d25865ff36d295f198e819dcee3
-
SSDEEP
768:Ovw9816ihKQLroCL4/wQxWMZQcpFM1FgDagXP2TyS1tl7lfqvocqcdT3WVdu:6EGU0oCLlwWMZQcpmgDagIyS1loL7Wru
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07480c35f06a32660604bcf480a8324bc0a7884efec7873b15358af0023be09a.exe"C:\Users\Admin\AppData\Local\Temp\07480c35f06a32660604bcf480a8324bc0a7884efec7873b15358af0023be09a.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F0AD31F-3021-4a1c-8E65-FDC861715C94}.exeC:\Windows\{7F0AD31F-3021-4a1c-8E65-FDC861715C94}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C05AD4F6-0E5E-4ad0-A7A2-2DF89F2EAC30}.exeC:\Windows\{C05AD4F6-0E5E-4ad0-A7A2-2DF89F2EAC30}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8442DA82-03C2-421a-A945-5A730ACC1B8B}.exeC:\Windows\{8442DA82-03C2-421a-A945-5A730ACC1B8B}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1A0777E-CB56-4116-8258-6DE3ABF8A78B}.exeC:\Windows\{C1A0777E-CB56-4116-8258-6DE3ABF8A78B}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C533980F-8C8B-42a9-9B9B-294E3F61BC09}.exeC:\Windows\{C533980F-8C8B-42a9-9B9B-294E3F61BC09}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BA861B0-CED8-4f49-B057-5197B7E84079}.exeC:\Windows\{1BA861B0-CED8-4f49-B057-5197B7E84079}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD24CC04-DE87-4778-B89B-2B77DEBDC874}.exeC:\Windows\{FD24CC04-DE87-4778-B89B-2B77DEBDC874}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6EE59D33-427F-46af-83CB-7621D1A49B9A}.exeC:\Windows\{6EE59D33-427F-46af-83CB-7621D1A49B9A}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74B8A384-10E9-40b9-815F-6787BBA9DF77}.exeC:\Windows\{74B8A384-10E9-40b9-815F-6787BBA9DF77}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B810378-5371-45c4-BA26-B98CEF850179}.exeC:\Windows\{9B810378-5371-45c4-BA26-B98CEF850179}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE4B0464-5AF6-4eac-93D4-489217FE96D6}.exeC:\Windows\{EE4B0464-5AF6-4eac-93D4-489217FE96D6}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D6C203D1-EB0B-4430-9523-32F7044A4285}.exeC:\Windows\{D6C203D1-EB0B-4430-9523-32F7044A4285}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE4B0~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B810~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74B8A~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6EE59~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD24C~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BA86~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5339~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1A07~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8442D~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C05AD~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F0AD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\07480C~1.EXE > nul2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\{1BA861B0-CED8-4f49-B057-5197B7E84079}.exeFilesize
64KB
MD573decb4543d5d51086e1c7b1cf928c21
SHA136e9b23ecee019ae540883fb2c90f28f944d39e0
SHA256f73f3445ea7e8c283c12ea9bc8ef2a0920e3ceeb57494fa506b1e12473297919
SHA512d58e8ad17d44d4a9c7a5b92fa0673ed74ea744c7c300e68f5dfe8770e85be241043f6a59ace2ca7e5b1f6ad404240df6ced82f0141bb806c4b2bc76d0e618314
-
C:\Windows\{6EE59D33-427F-46af-83CB-7621D1A49B9A}.exeFilesize
64KB
MD570cae864258ce422ef5ea1a03c60220d
SHA10f950b431fafaf92c6d46ce436cc435439bea226
SHA256b7ca6ce51a30a41a80825e30cde73b39261b44fd04ff26ec97944f85c06caf26
SHA51297970a9c2f92dc8316a5267db2279381bfcfbb5a1858c2961dd0ef75aeb886d60cc76fdcadcc48bb2bd97b0b07f36d80a20b5d3927f587b3b10ccc4ea6e2a6f1
-
C:\Windows\{74B8A384-10E9-40b9-815F-6787BBA9DF77}.exeFilesize
64KB
MD5b02cbf08f9a150e1509002a5992883ef
SHA1170cf0ae277dcb0a820c84fe30e04dfb005a46af
SHA256d4dae4d67095cb9849da6d365dbd191e249323f16a2c022cd30f78f1a969e036
SHA512130228b7db3519b1a10ae6f50c2270f3fa8ad0989ec24ef842760d410b5e751f19a360c8e583af63da028118b8149536fb06f2e31f040f88cb871e83d8ca588c
-
C:\Windows\{7F0AD31F-3021-4a1c-8E65-FDC861715C94}.exeFilesize
64KB
MD5d4ba76ac8bc2b97687fbd6f908668e93
SHA1fd9f9c006fade01649ac52dbf5a666bae61eb154
SHA256bfd15a04bcc6d0ea5132812f22d5a844a79de19d0c259016f8707538cfa7bbe3
SHA5123188b92f1331dc5f80df53e9f519eb3ade8e86c7107432219ff19fc49259e60472bace9d5b1f8d09fbc46d9cc1c241a8da4b8c9416412e266302c82bb640af1d
-
C:\Windows\{8442DA82-03C2-421a-A945-5A730ACC1B8B}.exeFilesize
64KB
MD5ec5e6d544a0682f33073ae3e8f2bf978
SHA12aefc2c72bac2ef5188729b92761d57fb073f708
SHA25608c1dae847e9c13214853f53c4d265b7397a102bdaf13541beefedd184544ad5
SHA5126ac0dfe68b5c4f0a6a0691eadb2fa37bf5d575be6a8ae50d74721b4ec5da004216889db6165bbad24d8cdb2b64f7f64aaf6930148067734393015a26a1916819
-
C:\Windows\{9B810378-5371-45c4-BA26-B98CEF850179}.exeFilesize
64KB
MD5ab88f39041ac45325054f55a323247eb
SHA162a8c4166c34baf688dc5b95e6b90e71f8e94287
SHA2564141b2bf8b49387ae4125a012d298737357139853a786948661a129c7983920d
SHA5124145bef5f9420e5bb03408f097cd52408759f441541d0574a2cad540cba8685e7e169229652ff804c50f08d7e3334a60d8fb78e7df307915f95f918543f659b8
-
C:\Windows\{C05AD4F6-0E5E-4ad0-A7A2-2DF89F2EAC30}.exeFilesize
64KB
MD5e37c5ec7740b37d523fa2599084c8c46
SHA1b95faf32dffca92cf70ec87e034df4e7de8d437b
SHA256d41394128703e17b1dfe3fd05ec3d5260ac7ec5348f66913c6a2cef469995f99
SHA5121a2c26827802ad29645d5d97a87a2364c875708c7b0f8bdb60d00d81a5f02871f180bf6e8b1f5072dd2ea67a41371973ecc9c9da35f6ad2f6f5f7d9819f43776
-
C:\Windows\{C1A0777E-CB56-4116-8258-6DE3ABF8A78B}.exeFilesize
64KB
MD5e08f0351446831f5c2a7d53dc014c0a1
SHA195b8624cd80e789d22fcf2941e6865f799cc8022
SHA256511ed515a3cd3d0c1be7524a5b6368f990686bd15828c2430c56dc4b0b8fee04
SHA512b2dbfb7b6bff858ca52a257e050f9a8eaf38b365c1ed00391725304d68b0446e96e8b37a1b2d20dd12846e86ed387eaa605625624448507eed430653216a805b
-
C:\Windows\{C533980F-8C8B-42a9-9B9B-294E3F61BC09}.exeFilesize
64KB
MD5543ddd55d8d0b0335c208b6bb6eadbf1
SHA15e0df9224b9ec32f379637ac75e884d7c9aba01e
SHA2567890e194a9286202c2fa50c2a9d849d40995e26fcb7e9fb2b79e08ae7406df43
SHA512b539569dcaf6c2001903cfde29b4be16fd3c6e82b9368686ad94d3fcec14f206accc4b538133dee28d4075b0e7903ab422fddaa007969e4d6a34fd1a4eb492db
-
C:\Windows\{D6C203D1-EB0B-4430-9523-32F7044A4285}.exeFilesize
64KB
MD50bac027311b621b968687a3c17198982
SHA14c60cc761619d27141dae391154b210c575c7960
SHA256f310d1e9c0ec140d87cd2c7a65cbb0c99d14fd44bfc1f204617ac8ad9938677f
SHA51213f1ccb520406cdbc810c36dd04d2c1a1397d0fa1ce1443f97e5650bd3787a97d8db31d8bbc8b52670286b4596d6bcb02e91a62befb8c4642ea4675354997b5d
-
C:\Windows\{EE4B0464-5AF6-4eac-93D4-489217FE96D6}.exeFilesize
64KB
MD58768c3e4f5c1630bf2f0045189363110
SHA1b4aacfa2cab5acdb8ddc0b46258088ab2d15c8f6
SHA2564a18aab128bc710ba6edbb27ac49ba7a5cd7d8f8695f2e19ee10a14c2e9f1f92
SHA51264c2bae2d45470299fbb5902612b7322ccb0389579f5f27c74ff56b658fd32d26d0a169e4aff6ce4cd8335522b052fa2eee6da37ec13ba9383037e03f8df999f
-
C:\Windows\{FD24CC04-DE87-4778-B89B-2B77DEBDC874}.exeFilesize
64KB
MD55b4b21308ccd551f269282bea281795d
SHA1228705d5ba3fb0a289fb3959345197772346326b
SHA256d63bd9643ea6b90425538e10cf378e5b789185f6a1e9d7600da5f2288bb39cea
SHA512a458a86c2e4f387a3a44b249aeb043c4dac8f04772dc60e972369697dc6b07f51427fca8ce73fc39284818c6ca1b2bf3287a4d73633d4371b8e2e68cb75b29a0
-
memory/948-70-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/968-63-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/968-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1484-23-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1484-18-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1832-29-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1832-34-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1884-4-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1884-0-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2244-43-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2452-6-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2452-11-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3336-12-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3336-15-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3368-64-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3368-69-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3484-40-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3736-27-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3736-24-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3772-50-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/3772-45-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4256-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/4256-52-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB