Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 18:50
General
-
Target
12c91546a90b0043944d1166a5abb8eff6b00b107bc55f109dab83216ff966b6.exe
-
Size
90KB
-
MD5
3c849686a1b6f718acd2a5dec301fd1f
-
SHA1
ffd03f4965e20dd554f635705f39b00d427ea61f
-
SHA256
12c91546a90b0043944d1166a5abb8eff6b00b107bc55f109dab83216ff966b6
-
SHA512
81ff85999f51866ae561342caf604033ca894d22ef07eb3b1696a2979806fc413a9b4cd0a9abfa236157c56e147b5992a0aaf0b6e39268ff2ef622bc173159db
-
SSDEEP
768:5vw981UMhKQLroN4/wQ4pNrfrunMxVFA3b:lEG00oNl3zunMxVS3
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12c91546a90b0043944d1166a5abb8eff6b00b107bc55f109dab83216ff966b6.exe"C:\Users\Admin\AppData\Local\Temp\12c91546a90b0043944d1166a5abb8eff6b00b107bc55f109dab83216ff966b6.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3D0F05F-C509-42e2-84B1-A91DFEDFF9A7}.exeC:\Windows\{B3D0F05F-C509-42e2-84B1-A91DFEDFF9A7}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{457BC123-3DE1-4d49-989A-0E2996876874}.exeC:\Windows\{457BC123-3DE1-4d49-989A-0E2996876874}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AB93757-1F81-420b-ABD5-13252E427314}.exeC:\Windows\{9AB93757-1F81-420b-ABD5-13252E427314}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
-
C:\Windows\{9FE0837A-BDF3-4ac0-B5D2-8FC48F383C97}.exeC:\Windows\{9FE0837A-BDF3-4ac0-B5D2-8FC48F383C97}.exe5⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D27C8DC-4633-457d-9746-EFC12F2073D0}.exeC:\Windows\{3D27C8DC-4633-457d-9746-EFC12F2073D0}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61932FE0-C5A2-47e9-92CB-76829BD6119A}.exeC:\Windows\{61932FE0-C5A2-47e9-92CB-76829BD6119A}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F17E8EF8-C1F3-45d4-AF2E-F6ED65F66CC2}.exeC:\Windows\{F17E8EF8-C1F3-45d4-AF2E-F6ED65F66CC2}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F859EDD5-7CF0-4322-8E03-08DC5DED923E}.exeC:\Windows\{F859EDD5-7CF0-4322-8E03-08DC5DED923E}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{787B279B-B889-4037-A0CA-41659D154B17}.exeC:\Windows\{787B279B-B889-4037-A0CA-41659D154B17}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{214123D1-9A3C-4d9d-9692-BD21E158188C}.exeC:\Windows\{214123D1-9A3C-4d9d-9692-BD21E158188C}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F09D9ACE-6CDF-42ed-8BF8-0C904897D719}.exeC:\Windows\{F09D9ACE-6CDF-42ed-8BF8-0C904897D719}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D7B00D2E-B35A-4101-AFAB-DE1D07E1A831}.exeC:\Windows\{D7B00D2E-B35A-4101-AFAB-DE1D07E1A831}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F09D9~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21412~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{787B2~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F859E~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F17E8~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61932~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3D27C~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FE08~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AB93~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{457BC~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3D0F~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\12C915~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD52cfb17a26096d14b175793d97da9e1d6
SHA102222900e1573d9dc1a7620a211f6871feb0bf5e
SHA256b38e0a2ccec84eeb91390375bdac19f3bd690118975d173ab833a89b48368978
SHA512cd4c958564b6c5dbd89245dd89e568fa1a6301a9b508d50433fb69a0be931e4a870151ddb0b56a7d5f2ff53e92ea325f071a8df5f1427a53639b16ddcd031e16
-
Filesize
90KB
MD538424c842f2884d2c6930b5291718ede
SHA1594e58e22f611a6bbd83352e93352b5cbf0806c5
SHA256929e8465053f8925f930820b8b069ef757b3f9022ccd81058842c1f64c2fd20e
SHA5125948433c9e6939c915ec3aedece716b7f3c7e051051f77a5843b7cb7e88fbef01c099d7379587f2cfeee11e4ae90cf6857465318c0c489ef945e8f69383cee74
-
Filesize
90KB
MD5c0e688f833a068b60c285f5811776067
SHA1ed5550f32324c3a7ba13e7b20291897f04cdf201
SHA256e94373cceca3d2ab1f6f475afae9db40276cf673ef0943f354bab8c8672d6254
SHA5121c04ff17f0c9d0bd47cf9acd81d4483a534520be9304bb77d20a26cf207f0a0f1aa783d18957ce4a53fb7ce5f3e2f2f9e52ec05a1ade601352d7a5760354be33
-
Filesize
90KB
MD5eb34ad3f7a16a8c20ad8819b6ca2a915
SHA1c6df06dc710d120dce6b3cb1c7948b63a50be464
SHA256208937b051d6cab920865465bdd602f5edc85372d420df2ddd05236ae9ba0d9a
SHA51299d9d9c3eb012e695f1e108498baf36aef8d8ef87070132a644de382b9031777b5c2bd53ef6f4a6deed7d72e29d63c0b454794510ccf2f95663ad58f7ae2242a
-
Filesize
90KB
MD582fdcfa223018ee9d5d8354cc6a7cdee
SHA19d4a1ad7fa08aeec4b554a54e50572768c53ceff
SHA256e165f2aaf881ad314734e034d22fb09c118fe2c720d66f9c5bbd7ad8cc72badd
SHA51210fddc9003039d13ec48872c03b5b5622bad8671ac05fd52e5734cfd400ab47bd8872fa4ee4c69a17eac4ab0213ae66804b2ca157a19e10ec3adf95d1e052980
-
Filesize
90KB
MD5d159f5507e77de5d2ffe37da4c1f481e
SHA1a7d6c46c1e3084369598a96b091c6633f59d4260
SHA256c2400f154cd0fe1d1b8be5eca15afa0184d4b88f2e456f74446d85293073544f
SHA51256c2315dbffc9f35171ece12f603e19ad2026b56375c2d3a13aa815f7cf2aba1f35ebd43b8b7def8a739c45c49fce0f77a7f155e6a9710115907f0e23618349f
-
Filesize
90KB
MD5a83033562db53e259937b4fcba78b67e
SHA14ef9ddb748a38f5a61303e6f2a700a49355f60ae
SHA2568fe3bce4adcab013d5afe7d90157fb6f3a80ed116aefcde8dd7a14ee77592c97
SHA5120949ca6018880aea22ce5dfa9873e8eadc685793496135930318ed7bf8443ee0db99bdfca3c555ef7a029950e6a56833ba9efaf55fae7e646f23b28797db26f6
-
Filesize
90KB
MD5ef2ecbb94d10eea1c47bf13a9b893ecb
SHA1a48b2cfe8a864a53c497e7282dd1e4dc878da0b8
SHA256861dd878c3f32dfb77eb5c36989ac577cdd966ead4f3d584694f218bb6443e40
SHA51233453fb1ed5834634d27bbff3e9694a20219d8003939bb506c863661b605d734f3e6262fc9d31d97d3aa39c496f246924f9bbaf1e5fc60f5a1c6682008bd33ff
-
Filesize
90KB
MD5473d6885da5b4c8129f5a3c2272feed6
SHA16942df3fa27213ea5346938ccd72ac3a62c40b07
SHA256eff40feedb1333df6d314d9cefde065c3db1bddfff6ed374571cb9bfa920496b
SHA512791bed3cc54b13083cb9319d72050b66f29f26f81c11a7ed134092e43fb2893309dd53b5dfa91c6d48a89a0f75ffd2322b23eb0bdb4e610b395750c6f1f8ec8e
-
Filesize
90KB
MD52ad451aa59e8a0612856a40301fb0caa
SHA1e9fec1cf21ac044754f4f4e4f11f0b8d19fd4fae
SHA2560be3a00c5bee786f7adc7d9bec6089495ce375c30a1e0cfc9a68c1c68c7e76ea
SHA512aa783809809899777aab0477bf4472dcc3da71481e98aa111d6a3405269c21220a9306e66fdaf3b9876e96244d29d4c026a444c68f19c0ee0112c28c8f59ecc5
-
Filesize
90KB
MD5f9bb59d2e486b8b3b3262262c1b1c278
SHA1f4b89381c279e672517a0fcbfca699b14f0507e5
SHA25651de07575cfb68bda7940d6468409540ed7ed02f6d0cb2ded9c31c427b787af7
SHA5122caa0ab94e6df298bc8d80ee4182c4a70ba45595c925112bd309a7d7475ebbec0984d14012a18745104db28bb98de3662a1e561b926556201e7cc80dfc77d24c
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB