Analysis
-
max time kernel
149s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 21:41
General
-
Target
522555764d7702aa33a966e1f1c17cd48bc77e50df751fc0c8f26044b7ac8fff.exe
-
Size
98KB
-
MD5
075f83ccf1c96e5a0693ade441a985d3
-
SHA1
71a3883e999cd337f7e50e03c93b0fdff528386b
-
SHA256
522555764d7702aa33a966e1f1c17cd48bc77e50df751fc0c8f26044b7ac8fff
-
SHA512
4d83111f4d7a3cdc53a770486591294c765c0e3ea3d658f1ce384a59ed534e0222770866f10c7723fde1a9c1996d87e066af5ab47d434d28fae58ef024438500
-
SSDEEP
768:5vw98169hKjroy4/wQCNrfrunMxVFA3b7glw6:lEG/HoylxunMxVS3Hgl
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\522555764d7702aa33a966e1f1c17cd48bc77e50df751fc0c8f26044b7ac8fff.exe"C:\Users\Admin\AppData\Local\Temp\522555764d7702aa33a966e1f1c17cd48bc77e50df751fc0c8f26044b7ac8fff.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{750CD811-CB02-4080-A588-E99B3FAB8371}.exeC:\Windows\{750CD811-CB02-4080-A588-E99B3FAB8371}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{099136D8-6471-4e8e-9FF3-5B30E0D44297}.exeC:\Windows\{099136D8-6471-4e8e-9FF3-5B30E0D44297}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4F9F999-4D15-4444-8207-65D6834515FE}.exeC:\Windows\{B4F9F999-4D15-4444-8207-65D6834515FE}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6503C825-FE98-45e5-8169-902472C14608}.exeC:\Windows\{6503C825-FE98-45e5-8169-902472C14608}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2590882D-F8B4-4d2b-ACE3-7A5A2ABA6E2C}.exeC:\Windows\{2590882D-F8B4-4d2b-ACE3-7A5A2ABA6E2C}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{606A9314-9EE8-470c-8D86-92CC70B16D4C}.exeC:\Windows\{606A9314-9EE8-470c-8D86-92CC70B16D4C}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F8C9A41-D3A5-4e60-915D-6CA1F4B2013B}.exeC:\Windows\{9F8C9A41-D3A5-4e60-915D-6CA1F4B2013B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBDFEDC9-593F-480f-BD64-5B8FD3D79DCA}.exeC:\Windows\{FBDFEDC9-593F-480f-BD64-5B8FD3D79DCA}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7A50E07-5A46-424c-8D2A-5C8827AC8C79}.exeC:\Windows\{A7A50E07-5A46-424c-8D2A-5C8827AC8C79}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C3C9E66-CCE7-4eb5-ACBA-1E5C9E3CD0C7}.exeC:\Windows\{6C3C9E66-CCE7-4eb5-ACBA-1E5C9E3CD0C7}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC5AF6E2-6330-4717-BB65-7E4BB3734448}.exeC:\Windows\{EC5AF6E2-6330-4717-BB65-7E4BB3734448}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{BA8C0555-3D56-43a7-89FB-5E935C567FDF}.exeC:\Windows\{BA8C0555-3D56-43a7-89FB-5E935C567FDF}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC5AF~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C3C9~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7A50~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBDFE~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F8C9~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{606A9~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25908~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6503C~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4F9F~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09913~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{750CD~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\522555~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5db18ddbfcd3cc5d2842f63ee21bc9d12
SHA18d4848bddfead97c09988c9a07bb958f280b6083
SHA256c0d424cb12568d3b7516a706183440bad996416c2b05592e07200bed2c187993
SHA5121fa9553bac95f63abc751f41dfcda0c6ac592fddaeb446c334530a264d011014d89f2e10cf974cc0dfda7bd1e5f68dddb7e8db3c9a7e4578e3800b532684db36
-
Filesize
98KB
MD5c224aa4f86c5a1c246a7586d39e6463a
SHA11d20172edbd5a88fa3270cd887e54f16a539fd96
SHA256f8627d7b6c720fe5e700da219ea1787c33480cfb7fbc8ebcc029b5eb1b6c4e22
SHA5126bdf56c7b8945b8ef2dbe2726bd42af761aa4780adf966d4274efafe972a9ae214124b68604d8c3a88341d37e7c2251bf8eaa006fcaa4a59516887a4cbc188dc
-
Filesize
98KB
MD535faac005e12e16459a0db24a468a908
SHA140919c7c5edb7760b927ed272b76ded44a72855e
SHA256a22824df355d5a1e231e293c646037c54d8654e44a5e5ad55af893fd8179bc55
SHA5129b69c2faf105852bcd1e6092e0e8c4342525140208f41040218e800dba4faede4d96ea9d9b4243516657adfcfff611b1a2d5680be772331dfdfabf5c0e5e63fc
-
Filesize
98KB
MD5856e78a89691b70c53a5fa20661702be
SHA1173538498abe03f6bc7ea71556ceb3bd8f00042c
SHA256a510908159eb32f70cf50fecbd450e1e90ecb721db891a3dd69076598b02e576
SHA51277c1cfbd01301271dd979ee407a04ba32919779d3587e6fb6f7289df95164147522f05aa1d62ebba0793c27f1e3d55b951aa3b4cb1f27ea99dba938d80943c9e
-
Filesize
98KB
MD52540cdd2dc0bddb358934498de49d086
SHA1be55905cac682d16d79a8f93bba85a150394b777
SHA2563e5ad8faf64070618f193bcd3247ba61955df36963cdea03c2d9d26e7df22ce7
SHA5128f9a23c7fabd72a0a0ed6004e5bce50cbba0110ba291c1ad593dde25856888283d7bf79c5c116f613ee1cb22559124ce55e57e9367dc49b1badb953d78cc0c17
-
Filesize
98KB
MD53e4b9e4b61de6284e7bdd972cca8d37b
SHA1c26337e5f7b2bbad32a86ba790c7fd714ce8d4e6
SHA256c9e44b67aa5fed8fabc9e4d183af27e6023687cf07d88eebd14bbec44a1f5624
SHA5120b615519081936545cacd2c697b67acb253c90976cde330caffdbc2e0a2bd72f9b891a07a7bf050f9c1fb94fb09d2e940ae58479c19f6a7e2ab2ecc68dd030d7
-
Filesize
98KB
MD5b648adc756943b0058d77e6ce0f245b3
SHA1b7ad5cdbf64f2e0930cbf7aef0cd75ebc5e4ed64
SHA2562c49ac487c8d69fc69938e75dbb1d7afd6ad6e62514aa0036e02bc2368e49bb6
SHA512c726c917576f8c762646e2625ba51bf7bd496e2a0649f1e4fb955efa838b6662fb90b4307c329bb1dce98f6cf3aee4196f36c5cf0cbead26ae1c83598e34e347
-
Filesize
98KB
MD5887c43ab846a958c3c52209687a58425
SHA19c99becc52de6647541eee27ca48522eacc2b9a7
SHA2568a8311c9e8a033af2a9fd7bcf5475192436f944efce3122257dcc5d250748b69
SHA5123996d73f9d16da116a117a773766208fe86cbb84d30ab1c490141f80eee76f64efe565aaa7b7e9a59f8af0e536aa8d30f8ba0183453cc47321ee7c435e335269
-
Filesize
98KB
MD50dd8d900b197ecded960b63c1dd5f72b
SHA160fd57fab0c837776a567ecce696f4ab794cd04c
SHA2566804a26c15e126981fd173fcdcf6e770b38856e99f3097e6c048210612ee4a57
SHA512c99e9ed7c862d14dba804ec2dd8755d277cf90a800e1ae141d72ff790ffe8736a098177885d5c66aac98ab22858eee5e0f206592cc51edb9bdf23fa35ec4425b
-
Filesize
98KB
MD593ab05a8aeaed17356db447c3bde444e
SHA188cd647226864a7f044d5c6700f9868612e21de4
SHA256a049fb157b72cb746f22d0dedfefef214a7fbeef4e0cdadc6be400324d580059
SHA51236c34181423b23bc1af53457203d89cf04cabdaf5ba680d4cbcc8fc82b41c73cfa3aa84c0f3f7a2effeff4ed0cb9dcb51781d8777a1495ab5cd2f1e5719bfa0a
-
Filesize
98KB
MD536a49ac0f32bb28ce6035f7480eb8f47
SHA171ad25d024f793a62facf0d4b0030d6f96e977bd
SHA256c5064a594c2daa258c443d4cd8ee56473ab1065a8e2d75e505c618a28ba59e04
SHA512493f0ebfaa40d78cf590beb7a97d19602e697f60d89de4e46079b3ee3706bcfb8946e9df8e243d55c78eccc1c7a56c5e64586ed8791b01f89f9f296acf4e4aad
-
Filesize
98KB
MD5fd2100a05c2255a5bb816919ecda8968
SHA111bc1768b4e990f05fe6632e81daef265e58d27f
SHA256481b0b8adea57d92477662c334a2331420f6b40b8afb0860d131636c5f110161
SHA5126ba9a3c96ab30942beac435f2842ce0c42cfab065d7d4c6ed9dd0d65fb0eecf6a44c1c632437d307140530894fe3d0df19f811360869f072e4858cc43cd9ca77
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB