Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 23:11
General
-
Target
74e3e271d5be0f82dee2a0b1f7bec99f498e123860a69bc80a58cd521cf9324a.exe
-
Size
98KB
-
MD5
8b79e64494cf88f07b7540c5fb9edc34
-
SHA1
85bb15b19b79929bbed8bb07ad36e541d7735e75
-
SHA256
74e3e271d5be0f82dee2a0b1f7bec99f498e123860a69bc80a58cd521cf9324a
-
SHA512
7fbe33f913b6bf0d8762e56c44751d936ef14e09032c0de60bcc62d0d7e3270463ebb6fb5209ce8a1def6268d5426b95f7ce2a3d96abd8efdc4b6eef127be607
-
SSDEEP
768:5vw9816thKQLrou4/wQkNrfrunMxVFA3b7glws:lEG/0oulbunMxVS3Hgz
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e3e271d5be0f82dee2a0b1f7bec99f498e123860a69bc80a58cd521cf9324a.exe"C:\Users\Admin\AppData\Local\Temp\74e3e271d5be0f82dee2a0b1f7bec99f498e123860a69bc80a58cd521cf9324a.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0983E865-8F16-42ea-AE80-13F7E2F75230}.exeC:\Windows\{0983E865-8F16-42ea-AE80-13F7E2F75230}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DD712DD-1E40-4196-8D35-19F29833DC80}.exeC:\Windows\{7DD712DD-1E40-4196-8D35-19F29833DC80}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1FA86654-6A9D-4131-81E4-7A6156DB7EE4}.exeC:\Windows\{1FA86654-6A9D-4131-81E4-7A6156DB7EE4}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{797DF91D-F4A8-4538-95F0-E32B61DC089A}.exeC:\Windows\{797DF91D-F4A8-4538-95F0-E32B61DC089A}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE595D9E-D06F-48a8-B505-577D9D4BC1B9}.exeC:\Windows\{BE595D9E-D06F-48a8-B505-577D9D4BC1B9}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83DF52C5-49B9-4568-AF9F-C147693DD492}.exeC:\Windows\{83DF52C5-49B9-4568-AF9F-C147693DD492}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A34B8AF-4319-4c5e-9370-D47C38D3C64C}.exeC:\Windows\{4A34B8AF-4319-4c5e-9370-D47C38D3C64C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3340677-2968-4f73-9080-17E6A98CA4DD}.exeC:\Windows\{D3340677-2968-4f73-9080-17E6A98CA4DD}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2111D28-885C-48c9-A055-896A7AE498C3}.exeC:\Windows\{B2111D28-885C-48c9-A055-896A7AE498C3}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB30C3CA-E251-423f-A65B-BBE61C2F3921}.exeC:\Windows\{FB30C3CA-E251-423f-A65B-BBE61C2F3921}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1745B04-A6F1-4c0d-ABCD-B56A6F18CD35}.exeC:\Windows\{A1745B04-A6F1-4c0d-ABCD-B56A6F18CD35}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{668F7ED8-5BBD-407f-9F33-EA9C9257504A}.exeC:\Windows\{668F7ED8-5BBD-407f-9F33-EA9C9257504A}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1745~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB30C~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2111~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3340~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A34B~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83DF5~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE595~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{797DF~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FA86~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DD71~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0983E~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\74E3E2~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5de62c6ccee552376c576142ecc7d3ef4
SHA1d704ac0249e7d90ef8e262caa3f4cf80b02db669
SHA2567f12be3f7c7a494bdcfaae28e72c114f5d9873d6cd4d1e7bb58159de134318e3
SHA5125059b6fee27d9f89283334e853380bbea5f5814c4f67f108ddae71c51162e2ce999c995de9e60f060ec243b20e76f28fd4fffcfb44508e9a77df1136d95d68b1
-
Filesize
98KB
MD5386613f6c553967fb6a7d25b68bd470a
SHA160e1fbd1771acc731b460aacdafdd9b781789eee
SHA256a270710c5cc6ebb39ec048477f271da9116edbab699eab9086e3a8e907af2c0e
SHA512c1211ebecee01c3942a27762c9c3b128a18f725379272c1c8972858e020a3a24088777eb7e80a520881dc1facdbb950176067aaacf9815a5117003673690bcfc
-
Filesize
98KB
MD5efa1304a795b8828050b7399baedd222
SHA17145b0b6b73940f6bec58411af8a25e3a3155c77
SHA256140b41ed6187553c7e8d0717483168068b0158db978f34a5082c67ef37531b50
SHA51226357487da8c03916a698244aed6fcfde5582e034a63f5a8a140246c9649cfd5e5f3d462b0c3a82cb4d7176586401c07ff63e7797ed9e04e63b1437e9ea2ce1a
-
Filesize
98KB
MD5c803c347f5f018f4c25d59297b32465f
SHA1a8ab46d6df4a4c71da0fed98a44aaee37ab68e45
SHA256cdb2937cfee9bc21e74a8eeff5601e8e86bc92a74db3d998e5b551d5d3457259
SHA51200c229b5a8032120b3acf910ec42c813490aad95bd29e9d5fb0f9d3c1cba8cb2d3d320c55b9be21ce2c33570eb7e01d3479fe95c79ee7a71472d9e649dd28a33
-
Filesize
98KB
MD5284de5c280b96ad6a484d75d63a36eb0
SHA137d3d675c19fa13054f9d1a46581214959ce7455
SHA25681f0aecbfd956a12470bfc2e94e114dcc8c1eeb3e14789d1d9f2d578bc55676a
SHA5126b3f21ed163fd41bc9c21cd1c14fa19e44e03f486c85bcc31998b44d5335d847fb6986d2d375608d5b7cde21ea9a84a6119276c2cb2c25e497719e450514e58d
-
Filesize
98KB
MD5081f11592f9e30424d067125146cc354
SHA17aff544b9388aff2fa8ec9530776ed2b5960d601
SHA2561f55f8f29d99dd532e4239134351de95f88e578fb8c451b39aff6daec215596f
SHA512f7fa62916976d743e3b38b94aff0a6ebea7b7313211366547ce09ad3e3aae23884c68162334ea85a8db999059ba807428a4953d28b979de7ab5803b9ce3ae6bb
-
Filesize
98KB
MD5b4d1988996430edbfc6295a9c0516cc8
SHA154fac3f7b00f1163e86490261f58483fdf879eaa
SHA256beba19f187aeacd532d5457dbc74c21326e4fdb5bb7a5be80dfb947f3fc80067
SHA512ba65f8c21e690b4a18be8276ba2e8b66e3837e26699afbe7468ac597a69d2bad064adbbad2f1cffafdd2930013c74889b09610efceb5d475bd09109f929930b9
-
Filesize
98KB
MD5eac5c2c09bf0873238726f0fe9186581
SHA16a35e1c7092e0417cdb6758d2d4da17a0b3b177b
SHA2566672cd1dea27a52e8cc1299a9e6744b82c5bc06b2a9e1a10a6dd68f0f184e878
SHA512a6106878941b80c8121576b81ea990eede987f99e6342e93ed14642799500cd83b5f2c76e2bef1eb2d52ebe63a51f5a6ee36c3d1aaac3cfa35161919bebaecb8
-
Filesize
98KB
MD52cd2320fc1a7bea33ef55710debbbd65
SHA10c973b64cc345a3df2fa6e5557af25718e454be4
SHA256286b960145f0ffa5e3437d3a1cc17c98067e9ce76e5c72794a0a707529425319
SHA512a496ea07f1bc7b791ace4297fdfe393b89b832c4fe0ab8bdd604156dbd4eb00ceac81940a6156aae9989a6a6e86e4104708232b36806f5f87f433c8ba8cd7e8c
-
Filesize
98KB
MD506f304940e5612e85fa8d0233362996d
SHA16c42d3f4d1f87fec3e5a87b9d4c43fcfecd222df
SHA25635a908fadcc95ea58bda01d793162d09bb1563d17877da1c5c72c3776cb85624
SHA512967b3fec7aaa84a1a5ab1cff864ff3475b50da782a2dc90c36b5627e65c3a6002ce6effd94d45327f9872e1a55be2929a3154a74cb7421ab82750c8cdbb53b5a
-
Filesize
98KB
MD5781124bc6189e2e79b06eedca4685b42
SHA17409cb029d59b86aa9e75a607ea245c96a2ac191
SHA2569adf172eadafa7908a6be9874888297a28d6653ae50430d70f2c7d1de496ec37
SHA512b931877ffee7d790b30c3e14141e99ad393a1f7b22ff20509ba2f3ed97110456d7117e481a65a6ff1fb682f4cab42360fb62b39d0cc29947062b5bb498a04d3c
-
Filesize
98KB
MD5dc158abfd44a8037e0b7f2a3b7f0af27
SHA13f51d9340de4cb3ca65b62f19540be26a845a49b
SHA256123d8980cda76115dbcc2848c2e80996410f9bac1abcb0b65ef183543341e3c7
SHA512aa0a548b2f36f81fbd2af58fe03a4d8943b1de6035e32d7a26e1a13c8e22cb1fc7abb7b08dc0be87e3414b4d0143e69b431cc137b06c37ce4ab51acf19e604d9
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB