Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
23-05-2024 01:24
General
-
Target
a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe
-
Size
60KB
-
MD5
82b2fcad7e278b7e87e35b9042bfa94b
-
SHA1
734df9d0e852d59b5e77be42d506562c73400444
-
SHA256
a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773
-
SHA512
f6c9b2a20f29a638188bf055c739b2da73d85929c9a904b879686620dd09196902fa3b04558833f5ccf522b42af1fe62e61362d519ae057bd9f48bcee511394f
-
SSDEEP
384:vbLwOs8AHsc4sMfwhKQLroy4/CFsrdHWMZ:vvw9816vhKQLroy4/wQpWMZ
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe"C:\Users\Admin\AppData\Local\Temp\a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91A5C274-9A51-42f5-AB4C-AE17DC23F8A2}.exeC:\Windows\{91A5C274-9A51-42f5-AB4C-AE17DC23F8A2}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A1DE429-BA85-466a-922F-88EE05D9230C}.exeC:\Windows\{0A1DE429-BA85-466a-922F-88EE05D9230C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEFA4F7A-6EAA-4aaf-9C7E-57AEF62C3EA4}.exeC:\Windows\{CEFA4F7A-6EAA-4aaf-9C7E-57AEF62C3EA4}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EDAB3EF-CEAF-4f48-90CB-4889C32062DA}.exeC:\Windows\{3EDAB3EF-CEAF-4f48-90CB-4889C32062DA}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB2F53FA-6A3C-4410-B214-B383DCB2CECC}.exeC:\Windows\{FB2F53FA-6A3C-4410-B214-B383DCB2CECC}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C1171DDA-6041-4ee3-80C7-36C002998BE0}.exeC:\Windows\{C1171DDA-6041-4ee3-80C7-36C002998BE0}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89618C91-0C9F-41ed-85BB-E2F91F0CD89D}.exeC:\Windows\{89618C91-0C9F-41ed-85BB-E2F91F0CD89D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{417C25D3-BA86-4492-BC94-B10894F73EBE}.exeC:\Windows\{417C25D3-BA86-4492-BC94-B10894F73EBE}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4422BCE8-9A96-44ff-8032-31A7E41B04B1}.exeC:\Windows\{4422BCE8-9A96-44ff-8032-31A7E41B04B1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{0968E080-568A-4288-95D4-636A6EB12E93}.exeC:\Windows\{0968E080-568A-4288-95D4-636A6EB12E93}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{EAD04B80-DC26-4856-A008-97F961858210}.exeC:\Windows\{EAD04B80-DC26-4856-A008-97F961858210}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0968E~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4422B~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{417C2~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89618~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C1171~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB2F5~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EDAB~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEFA4~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A1DE~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91A5C~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\A5D185~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD57127bf7b9e0ebc1b1407e487abfa0434
SHA18f980a5a9418292e72eadade40e8368c9ac54565
SHA25635479ab4fe66c0009305321414e5781dd1817f581d0f1f238dd16d5f2381eaec
SHA51283f71eacf74b8bfc9e1d3aafe3c2932915ece1a4c50230c2cd646951495e6270e205d8b2f0ed618a9c95204b02f98f41069360d8bd20d56af3b6bb92f7bc5922
-
Filesize
60KB
MD5580a75781dfdcced93cc2004733a6b20
SHA1b3504c6a17b9b631dda44812473d01bb116d1aa3
SHA256b0bc58c68799360ead7a1746aac9e79dda0eb75a8e5eb2c3da353753b37c0672
SHA5129c73c07f0defc6a96363187a09c6280b9050bb0952f6b5504b8ac09148e2b6be31fdc2ab1f1f8a604029dbd5263c19e2ccf8995c89b4da7070758f718b2c2a61
-
Filesize
60KB
MD58f552613e7e6186739dedb623f86d215
SHA116ad0024f1a34d3d0703c5754de414be3b409f9e
SHA256d48dd800ce5de240f720e88e35042905d461f9a142741d6f507649b8be88d6dd
SHA512f046d45667f18187984d48528363b50540fc7ad304d4948e612247f2bb8bac6ff7da3201e4e0d46c6fc26970166be335a493256fa02584fa4438504d5b691fe4
-
Filesize
60KB
MD51895776e2fe485f2fdecca7da6f246cc
SHA13f4b9a12c80945eb69baff407cf56f81cfc6e8dc
SHA256d5dbc7ce7b14d764f589635e6a57410c820eb0603f5d220df3f1f3177f00bbca
SHA5129cc63318f65e9ccd4bc65041a33c255449bbadf6f9d03225778895faae0bba6cbb10f5381d1b8858da1b98f18f35eea8f4a881c7ba1e50ede3add585ea94ed85
-
Filesize
60KB
MD5e01084966621b4cdbb9537556a61daf6
SHA106ebf7b4379d10dd9899289c3ad36eccaf6927ec
SHA256b586d102619ae32edfe49d69c3b9ea0c496de66551d39d954a231c6302a4083e
SHA512814b5c285b1da2b45354cccde100788560360ed28fc4d5dfa64eee1ee24f714c3bf672db4abdfa5f41a64b9d8dc04a35a40821a82eea47418536f23b0237ed44
-
Filesize
60KB
MD5327d43fe3aecaca4368e205c16068153
SHA1c9bc825289506f7c3eed6474e822f1b6926bf18e
SHA25677c2e8f2d83e3a8649a4ac0b11ac3dd27338d32b5683a7777bd638650a2a559b
SHA5129a72d1388e2b6f25a02df6a3f5bb6c631f081da53951c4f5cdd96c8b94d29bf453612be4a26e76a2e5d9e945432a5abd3f3fbeb55140d825b8010b79668061d6
-
Filesize
60KB
MD5975e0863ab1ed0dbcb0f9d5f7325493d
SHA1517fdd899c83f8901f73a3f367444b97c4289f58
SHA2567da1b30b03e6202dd10b73a17065a6e0bf39bfcd530f05eb6decf99dbd1e87d8
SHA512a863e98fbc3de480f5977158a28ff78be65a0fe8c5990d4290d1ac78a78b5b244bc20dd651bc403739c7e92eae939f66a651d8786d74831d3d25ba864899531c
-
Filesize
60KB
MD5397f199ec9c89826c62cf9b3109ae0d7
SHA13eabd627e07c609097a8af0e456737eb7e1517ab
SHA2565ebc29f6c5427a5d61058ed5d90f8dfb2aed29b5e1ede2743f1fd084ae969680
SHA51233ce6c88521413a8422f6a818514fa17b4538e293d975dffe3f27b82b15d7029ca4d07481a3a49ecac2c20cb6fa8c41cc8203d973056dc89813d4df5d53c1541
-
Filesize
60KB
MD5fdc133cc8f5cd0e1632d8378991a7b86
SHA1d8cbac303dfce35fb92e55c1bd2a2cc346d89100
SHA25616fbcf6dcfb005ede34b6da743aeed6d5a9e184252086dfc52483954dc77585d
SHA512691f54f3332e186659d46b19d55aba986688baad61e957e6514d52e8010d7055ad7c42f7df883a728900edb5697bc79e43366731bdf33e97220c07615b6bbcc5
-
Filesize
60KB
MD553c1d2faf0c70aa2791665f1ae3c47c9
SHA173a12624c867c04bb1de2c6dc752aadd4555df3e
SHA256d8b66544dbfa4dc325c9fbf872d8e31e910f2637b4d8425353d0e62b673b5cb8
SHA5124cc882e65554d0192dc66b00733ca76687d936232a7c1ced3da0d8b551016052add45257cc29fb33f3d31197d0e557c650734ebd851b7c1bdac8a1f8508a703b
-
Filesize
60KB
MD5c94623c448ffbf5205d3ca8e6ac30cec
SHA14211516c6af66570bda59b7da0b3bcf53b9ef2b9
SHA2564c99765e82f5034a5a1a54ccb77e71c14306988ff24532b06d44030a2b54bb3b
SHA5129b915fd1addce9e3420b9952f4dbe773940389007ac4d7f4fe0de1dfb5a58e19f09b3986a913942634779f4915f5985e2b7ac1c886dcdf56688eacc93772ead8