Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 20:32
General
-
Target
38f0e03d8d24dcdeff6bb71adb7cd8498a7652219711a4858d229b885af2ed13.exe
-
Size
90KB
-
MD5
f535e0785a5bc873f14ed58062b50d32
-
SHA1
e5dfd90b4df5a07efdf3da0b175e6129b840250e
-
SHA256
38f0e03d8d24dcdeff6bb71adb7cd8498a7652219711a4858d229b885af2ed13
-
SHA512
80d77f7c8be28de1aa98f20a689f89b75c2fb35f63775ca32fcc397e4553867bef590eb401365d8e874dbea8035252e7c6c4c486edd8f28b59b3f2df64ef98d7
-
SSDEEP
768:Qvw9816vhKQLroi4/wQRNrfrunMxVFA3b7glws:YEGh0oil2unMxVS3Hgz
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\38f0e03d8d24dcdeff6bb71adb7cd8498a7652219711a4858d229b885af2ed13.exe"C:\Users\Admin\AppData\Local\Temp\38f0e03d8d24dcdeff6bb71adb7cd8498a7652219711a4858d229b885af2ed13.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{696D0C96-0338-48c5-83F5-4B523A368851}.exeC:\Windows\{696D0C96-0338-48c5-83F5-4B523A368851}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96BC0FB3-1B86-445f-9B98-21BDE0F801E2}.exeC:\Windows\{96BC0FB3-1B86-445f-9B98-21BDE0F801E2}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB4FEBED-3EC0-4f52-8407-969296B3F08D}.exeC:\Windows\{AB4FEBED-3EC0-4f52-8407-969296B3F08D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{709E2D03-85BE-44eb-ADA9-7FDAF3576E2F}.exeC:\Windows\{709E2D03-85BE-44eb-ADA9-7FDAF3576E2F}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D52EA9F8-4E75-47bd-9E1B-48CAA322E629}.exeC:\Windows\{D52EA9F8-4E75-47bd-9E1B-48CAA322E629}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8ABCB907-64D7-4eae-82DA-F7DAB8BC4744}.exeC:\Windows\{8ABCB907-64D7-4eae-82DA-F7DAB8BC4744}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B374389-6E13-4d14-9E47-D9D23A30CE0A}.exeC:\Windows\{5B374389-6E13-4d14-9E47-D9D23A30CE0A}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4EB37B3-4958-4c7a-9CD5-8C60E6260D5B}.exeC:\Windows\{C4EB37B3-4958-4c7a-9CD5-8C60E6260D5B}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{00386AB7-DCD5-4fc8-BD3D-87C64E444090}.exeC:\Windows\{00386AB7-DCD5-4fc8-BD3D-87C64E444090}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D47AE181-89EF-4e09-B7B1-19A520D32CD8}.exeC:\Windows\{D47AE181-89EF-4e09-B7B1-19A520D32CD8}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A9A2AC4-FCD9-4f2f-867A-07943EA06EAD}.exeC:\Windows\{0A9A2AC4-FCD9-4f2f-867A-07943EA06EAD}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{5296929F-6D59-43cb-8540-B650E3598203}.exeC:\Windows\{5296929F-6D59-43cb-8540-B650E3598203}.exe13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A9A2~1.EXE > nul13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D47AE~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00386~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4EB3~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B374~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8ABCB~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D52EA~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{709E2~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB4FE~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96BC0~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{696D0~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\38F0E0~1.EXE > nul2⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5fa419aca02a884c7e892a98551114fb9
SHA16a37c0efcd48a4ee6543ed0a5f906faa39807a06
SHA256162d472dc486f8022bf15d338a0a136c247f44d3e99027bc815f5fb169c5c234
SHA512cc57108ebd0d17258a04dcb8b9b96fe0fcf6509f6850ba3f1bb6b6c00db3cf01d6b8c389a841acfc2cd8c23b32edb97b4d63485f6ba70b899834a6025c1a756d
-
Filesize
90KB
MD501b3fc1875fd143dd77071e5f3469471
SHA1ce6228dbc8949cd1ab5987646d17f0c93902db70
SHA256b53e6aec94a928e859503265305a506353c8482f8a9ddec087e1bb4f58762b7c
SHA5127763e297ee017c7d4f3dede75ac44d396a39ef3b702a79e842193878692a88482e4940097626200b363cd1797bee26427a0386a3f9a87fec378e73666f62423b
-
Filesize
90KB
MD50f7c35078824c59223270c06d210efb3
SHA1616bbe4784addd487444e38c61f1e6bc54354e86
SHA256e6b938ecda213e02c38f2b57c8789f806ca8f142761f23ede2d0ff1d41cdb566
SHA51220b225d32eb10db395ef1ad296403799336c51fb6a0cb80bb552e33cf9703ed1b505f11ee0015ad03f28fc541f65885bec2a6269dd27f58dc2407312e724afc5
-
Filesize
90KB
MD5f09e262b93300f17e1f392e049f6ce0b
SHA1e541a6e6bd5596f43278de0f09cec4efba451074
SHA256e8d952cc5b66c36c574800f14721065fdde2fb6db0bbac4c5fc1ad37c5fd6e13
SHA512457ee307e1f4f33dd9f6d43cdb34862ebc9a88b66dc0ec4ad98f2991848ad5c740fe949addfc3b73b0bf2884755abf9c726d2d9d892ec4174c66e30cdde5ec8c
-
Filesize
90KB
MD5c0390e74e48307eeec97bfaf9828d754
SHA17a5000db23ba66f49faf5f5ac0daab224f828ad8
SHA25694e7c9e54c33cab646a4c452cd13f1b70aa72e3914e4d38f48877e178ecf0c87
SHA512cc27e396ce74a8569b727ffd180f6b06ae53948aaae13cb695ee58d9f6563dcb0ce3d1d40510bdb6b0fdbef8217e7d3ff8210744eba7d4465cc0002eb3b15bb6
-
Filesize
90KB
MD5d364ac843fdcee4f9967a2e772b4c31b
SHA18e49bb2981066a74395868c3aeb4fbe509b45996
SHA2565182b506a00535e1ee48ef52cf8627025c8ebdea578ebc0701ef1c262dccbda6
SHA512669f6dd73bf0c331839977488f38e9b1658608be345fe560aaba3da30d50f45339072e76cd68a52bfe6b1f4725ed6d47d0b3f8cf86ecef2fb99c28b5aed69a81
-
Filesize
90KB
MD5ee8afd17af2f8fe915ea64e9be684da8
SHA197169e945e267e6b290492fb16ba92b82d23ed01
SHA256b96cd5ee0d17d6011a5c23c59b8f7f53bd1a6d0a2ee9587ea56783a03c2dc916
SHA51264971d6dc56a584bec8e937eef8cffb4a4025998bfdcd3fd6e5e5c5a2d6a6f553f2482905d02c9dccd0ba0063618dfb767825523bbf13c0a37258e1852da80d8
-
Filesize
90KB
MD512c662f6a217186900859e019561f26c
SHA121e8b4b950e4e3af3dcc70bc872dc9d0e9b7d4fd
SHA256c90490f2a03a30837634ea3ded6e36a2db48e3643c3b99e08e0191f8040c7c67
SHA512727f9c78677e84a145ca557c3fcd10ce958a4669322a8ff643d63c2f89668d0e2d827e9a4dbf7bea69d8da4d66bbdb239e90d669d8927f8a8f1ae67e367d3809
-
Filesize
90KB
MD5d05760dd7ab6d2477692dabe69209f05
SHA19fb49d7ee2e9a9b6dfc414e0d07e980595e53f0d
SHA256d335513a0463f934e8160db32295118d412c103599b515be3f3fb43a5fc98afb
SHA512482fbf90f150d34ea06f347770dffe8fede2aedb811e248bb4c7bb1a1c88d2c48f2cfe7b3edf7e104a8a981b59da85f6f108fb0d00df6923bdf5073908c2283a
-
Filesize
90KB
MD5f99a22fb624dbe883890431ab893569b
SHA11c700cb9c26cf6509ba7e2d363d090548375dca9
SHA2569a6b9a92f96fcb2d0f9834e38c602c747e1e411ad959df7821be1bf3d1dac576
SHA5127e6a0929d96591c7de3e0d0afcaeb464e07cf8f9a7ed5ffc10940c571f464cdde5dc6369d3f61d98c12f262fdd55c7baf52acbc63149089102a504b86b3e7419
-
Filesize
90KB
MD5ef0fb7fa22385a5e7f9276ae52339334
SHA117d57c4eafab4938b7ca586a952110146dc6924c
SHA25668d27764286ce91d47de4080befff5633228e06ddafefdb60bab46de336cb580
SHA512576df18c091265d4475daadf7c7d45a1382589cd6088c05b2a279b5395af6279aa8dcff1af9c6d293482e1dc624177952bd41f88d2ad8b83233504f22c6054a5
-
Filesize
90KB
MD5fe2e169efb3ebcfc605075b034e68118
SHA1dd77792fbb06c836d8c2c878e5770b8693a303f5
SHA256f9ac3acd5c2bf038f023116b97e234f6594e464ed655795b63507e4d3eaa5637
SHA5126a3a671c25415842cd045c50770e41fdc0e5eda6a3cd8757ff8e0f86a911065e30fc046def12e8881b6204343bba233420ac9b84cb4d347f6a0cd66fc0250531