Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 00:55
General
-
Target
66dc6c59cc77a27c4bc7190e02d03c487c6cfb36d62060fde5f0fbc0f2442866.exe
-
Size
135KB
-
MD5
28c450127304cb7dca5ee42830c680c0
-
SHA1
400ccdc95dfb43ab8730072cd1bdfbabe6e28337
-
SHA256
66dc6c59cc77a27c4bc7190e02d03c487c6cfb36d62060fde5f0fbc0f2442866
-
SHA512
8e1a5e812db5ad6096b2127ade3f087fbe9bd28ad5a2cd97f61a1d6031bccbde7b50adc34f8526aad01f1a85e85d7822de5dffded0b7d8f35dc0156c9155f5fd
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVPi4Vg6k+:UVqoCl/YgjxEufVU0TbTyDDalc+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66dc6c59cc77a27c4bc7190e02d03c487c6cfb36d62060fde5f0fbc0f2442866.exe"C:\Users\Admin\AppData\Local\Temp\66dc6c59cc77a27c4bc7190e02d03c487c6cfb36d62060fde5f0fbc0f2442866.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5893be6119cee0a3a7b61f24e0777c180
SHA1ac620222017ff2d32a7bf0d1085c0a09105ddf99
SHA256480ea97cc265e3f9819247008f0e12c9ab633adb44cd8639b534def4b7be65f6
SHA512462ee5e0a7384ec44518d53b34614c94ab7cd507da4edf2f2781c1f5fc94221f73fd8285f9b3c931c88c7c56de125e52e4ae0ae602ef943e0bf62a0fb5f1d457
-
Filesize
135KB
MD528ec3b75f555058ed8b859c5ececef4e
SHA1c41baec1c6c7e3ad18f243da0f237510e68a484b
SHA2564d160632c280f469d2b397559d09ed0fcadceb96ce27d95cc81de2a209ccd74a
SHA5127e2942daf9f585cfba26d6286a24e795b226086a0795b8a6683f7502e836fdd9024e37a4a015d68f1f8ed8684687a7aa6d9cc5dc74f27d39a117ad3b6b4e7ad4
-
Filesize
135KB
MD5662f137e0f22e03b5f902e3444f20f65
SHA1affd45ef7780972f1a3c9d17725b851d08f28ced
SHA256dc1edd47e493ded8f33f59ca30a0e1126a2ef765c6e71aadda3851d7ac3a168c
SHA512dcdae7de412f440f922fb84c7adeea49294702c4320f98aece0f51539cdc34310d112221a745adc3405913c1816bf98600bc341e7ee279ffbf66ff1b72913f5b
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB