Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 22:07
General
-
Target
48052be116ef0365ef0aa88ef6f845471ac7b8542707d53d82778b4b96340953.exe
-
Size
90KB
-
MD5
23818e2b50c077610d449eaee547aae0
-
SHA1
86ac4d2e4e28d89781d9b5570f62098e7e60e613
-
SHA256
48052be116ef0365ef0aa88ef6f845471ac7b8542707d53d82778b4b96340953
-
SHA512
1da1dbe81d8315c9257c8ea7d3cb98a390c75fc536918ad09f300ca18b019474e675e6421521c7e1dbcfbfab69463070aa7b7948b3bcfe62e0bb73d2320c9afc
-
SSDEEP
768:5vw9816thKQLroJ4/wQkNrfrunMxVFA3bA:lEG/0oJlbunMxVS3c
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\48052be116ef0365ef0aa88ef6f845471ac7b8542707d53d82778b4b96340953.exe"C:\Users\Admin\AppData\Local\Temp\48052be116ef0365ef0aa88ef6f845471ac7b8542707d53d82778b4b96340953.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1FA1F4C-A396-4023-B98F-2790464214D8}.exeC:\Windows\{A1FA1F4C-A396-4023-B98F-2790464214D8}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04F68372-624B-4da3-BAB9-B2341AF881D5}.exeC:\Windows\{04F68372-624B-4da3-BAB9-B2341AF881D5}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF7B51FA-C917-4dac-A243-F726D00CF320}.exeC:\Windows\{AF7B51FA-C917-4dac-A243-F726D00CF320}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC39C5D1-6425-4392-9B5F-FCC852D00AE0}.exeC:\Windows\{FC39C5D1-6425-4392-9B5F-FCC852D00AE0}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{62B49D70-B4F0-46ea-9C10-1C97239D48EB}.exeC:\Windows\{62B49D70-B4F0-46ea-9C10-1C97239D48EB}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0273A6F9-6F71-4576-912F-1B67532C0027}.exeC:\Windows\{0273A6F9-6F71-4576-912F-1B67532C0027}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{342BCBDF-9167-4ac3-B088-A42483410314}.exeC:\Windows\{342BCBDF-9167-4ac3-B088-A42483410314}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A23C87B-0641-4c22-A310-37B4BFE115B8}.exeC:\Windows\{5A23C87B-0641-4c22-A310-37B4BFE115B8}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01FD67ED-4D45-4a3a-8CC4-8F08C13A9249}.exeC:\Windows\{01FD67ED-4D45-4a3a-8CC4-8F08C13A9249}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2458486E-BBA3-4122-A100-F514229557C4}.exeC:\Windows\{2458486E-BBA3-4122-A100-F514229557C4}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E3FDD91A-0771-44a7-94DA-5AE5521118CA}.exeC:\Windows\{E3FDD91A-0771-44a7-94DA-5AE5521118CA}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{A31562BA-0020-4bd9-838E-D7B86B10E15E}.exeC:\Windows\{A31562BA-0020-4bd9-838E-D7B86B10E15E}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E3FDD~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24584~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01FD6~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A23C~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{342BC~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0273A~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62B49~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC39C~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF7B5~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04F68~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1FA1~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\48052B~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD58f87af20e61cd0e34a9a51dce46181a8
SHA1944db5e5d1fbfbfc02076e66fff0acc024c9051a
SHA2563dd865f575b357da7a1b85600ac0a4a447506ad429735fa3a7a8a2251a22f92c
SHA512bd411c41628f8590a1fc0f1d1ea7f1187074071ac41b4ffb388e2c310b317ebc37f7f47ae5804e06493eb92c9720d2938b584fd0712eba117d833c280c69624f
-
Filesize
90KB
MD578c4b689b1ee08493b7731fd7a9e5ca5
SHA1c4351a00c15d7d9784c0c13c90053a7cc925c677
SHA256640f351277c1444047ba8f3fd6658df9a40992d3885122078c15cfb4d920703b
SHA512ae368e88082fb40126859082d1afea013736e9e4c41e90a5eb757bf36fc490c665cc77237ceef4e22f2e00018754bd29a23849792ef10835295dd8c54d67142a
-
Filesize
90KB
MD522b2a29738b34df1615406c67c00ea1f
SHA157eb14c81691f73261d6153f64e436fcde27e37a
SHA256f344d02c39a0d9ed42e22d3c5fa3d18618796f93f914df15c9327d202a0e59a2
SHA51202486c3d2cb55da0d670dbf88d794fcbcbe5ce41255eb5967ba9eff0de1e85f21012187d5f3512992767f252efabcec24d06088b960614be133f84f48a14824d
-
Filesize
90KB
MD547cae79f556a64ea4f8ccef9421bffa6
SHA1335b7412b3c10558fa1b9bd5a73cf65ab5ccf387
SHA2563fd9ddec4a6bb5a3d3966396cf2dfb396607d884ebd6b2f5df513aaf024836e2
SHA512c24e9771312f53bcf5944a821d80c49331821b095599706b4a75566d427a66b57c0b4327494e55712efec1c1051daf42421aa294dc010bd45a5ee583b669df68
-
Filesize
90KB
MD57c8de0e15b795803549395e835d6f710
SHA111fda597b3c8b85093b2cc9d480760400ffeac89
SHA2561b42a79fec099a0b57b01f4e8964e1d776a1126ec8b0c7432d454868bd19c538
SHA512e35a956833bbe48bf66fe175aa3fbba41a76b6dba0812e8c8c4970fda80afa11dbff429b3dc2e8f4f63392afd43a365935f4cdf648c84e5740ac80ac35da1850
-
Filesize
90KB
MD5867f52c605f8ad45fc4d1b63137d88e7
SHA13ffb6ab6fd1ac54ec28864130fd07b73bb034213
SHA256d673758cdfcac371114752a9b208cf8a6aab28e5d12a1ef4de4cfd53149126eb
SHA512b7e650243689efb1b9af04506410dc53f07ba0724f1f3f3c5f685073269d62c0612406fae8738a8299e745d56272db4058e5cffdc89068c23d6713ef7e3e5e7f
-
Filesize
90KB
MD5e99a900259295ac7a204778c2224d4ce
SHA1ad2ee635de13d8fda521c51f274d5b20c20ea1ac
SHA2566b9125c2ebf5f9ef14c425c6b170ad8b81d8092fdb57ff5434961ea7c9beddeb
SHA512500066e3587d9444adc610aef7fb9c530546e6d4c85b682b40dba565d969b670fe09fd76d2999def7d7d7d1a1432c5f8158d63ff1b4380766aa1802a46f48a5b
-
Filesize
90KB
MD5dcaee2a9a0fc8356cefcffbec1428c98
SHA1bde6761f40d3d638ac5d540933078b21f6cbbee5
SHA256de33f7ca5078ce5e21a23532bcb87bfa94c30fc47953e0c285fefe7898dd7928
SHA512d2782fbcbe165b2b3b167acde5aab012538269f1fbfd8efb76e1cee0ebb6de39104859879e9641e47c614c2ca93231e64ea18b9e1787d6b79e63dedd440f035a
-
Filesize
90KB
MD5d89ad97251a5e7f9d3ac8d5ba790c8f3
SHA1f4fd5b1812458a9a8271f7f8f5d20bb0afb568b6
SHA256c279720574212929a0caceb98cf24af04160c347db725368ee10052a05b1408a
SHA512ffb7846c5081feee6bc9a9652edf1504ceecda5d358c8febb79133f499fd2dc0a1e5847ecef2f95fce687c30e83bf2b20a308a9c6d999e18a86fb2b6c400d33e
-
Filesize
90KB
MD5b7107b5b6b44bbf7f1656ab0969171c0
SHA14782c65525c383419119904e5e9fd74fe543e7e2
SHA2564a59a05c342fbf2b8da3541982341dfbbe4d32ac7bd7ee761ff2dc4f500b8068
SHA5125351beff96168e5189917db9fdf5c82d9157799441832ca087b693e15f23d480368aeb36953ccaadf83ed2b71958117a43f860c1f272038dc27d249aa4b1ae3d
-
Filesize
90KB
MD5e6ac60ba49333aa17ac60e6f105459dd
SHA1f1431e3aa35c03403ee1b315cf6ca57ef269d936
SHA256afb0d2ea4948e5785edb86591550b46eee83f99cf0688c01463fa1a79990ecdc
SHA512d474c1015003f49645e8b7b3ba38eb103ce0cd317d18511ced277dc4ffb109bdfd659a83e1b110085ae83d464a0d6a1d2f91875d10d268e4d1c800ca9cee644a
-
Filesize
90KB
MD56413eb49afe8b883486296a55e18cc5d
SHA16e499e7ba13c97b59176351493e93f2a12431c8e
SHA2560de03059695f6eedd908f2431fa1ba549eb4bfb34d4d47cfbe982be665e0ed6f
SHA512347989d15af2a9f45ad5d07db40ef17c5aea83e918379e35497d5270ddcc9e36448a29454ddfa56d4256c124986b6cb0b4d3879727cf3e8fcd01001abc96304f
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB