Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
23-05-2024 01:24
General
-
Target
a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe
-
Size
60KB
-
MD5
82b2fcad7e278b7e87e35b9042bfa94b
-
SHA1
734df9d0e852d59b5e77be42d506562c73400444
-
SHA256
a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773
-
SHA512
f6c9b2a20f29a638188bf055c739b2da73d85929c9a904b879686620dd09196902fa3b04558833f5ccf522b42af1fe62e61362d519ae057bd9f48bcee511394f
-
SSDEEP
384:vbLwOs8AHsc4sMfwhKQLroy4/CFsrdHWMZ:vvw9816vhKQLroy4/wQpWMZ
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 11 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe"C:\Users\Admin\AppData\Local\Temp\a5d18583fcb1799fc9cb8556041264543258986d5b6922775cd869d788ef4773.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7847DBF3-030D-4142-8012-049F52819CCC}.exeC:\Windows\{7847DBF3-030D-4142-8012-049F52819CCC}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D8FEEBD-0D47-4c44-9F7A-EAB89600A9A7}.exeC:\Windows\{7D8FEEBD-0D47-4c44-9F7A-EAB89600A9A7}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F1B3AB7-9405-44fc-9CAF-46367EEB3E3D}.exeC:\Windows\{2F1B3AB7-9405-44fc-9CAF-46367EEB3E3D}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B23E4EB9-AE41-4d75-A06B-E1AE709BAB3C}.exeC:\Windows\{B23E4EB9-AE41-4d75-A06B-E1AE709BAB3C}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E4F61AFA-FCAB-4603-BFE1-069919BABF66}.exeC:\Windows\{E4F61AFA-FCAB-4603-BFE1-069919BABF66}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0D04785-3E09-4cde-97BC-221F34978E64}.exeC:\Windows\{A0D04785-3E09-4cde-97BC-221F34978E64}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D98CBBC-912F-48ce-9D59-48C48F4D2645}.exeC:\Windows\{7D98CBBC-912F-48ce-9D59-48C48F4D2645}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E777E8A5-9213-4576-A566-21EC354E6778}.exeC:\Windows\{E777E8A5-9213-4576-A566-21EC354E6778}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21011CD7-D4CE-4e8b-BD81-57057B8A6B3B}.exeC:\Windows\{21011CD7-D4CE-4e8b-BD81-57057B8A6B3B}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85C4F59B-8EA0-4cba-8040-CD830D85C64B}.exeC:\Windows\{85C4F59B-8EA0-4cba-8040-CD830D85C64B}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AF6DFCA-49C9-430e-8377-7CB78F2A1078}.exeC:\Windows\{7AF6DFCA-49C9-430e-8377-7CB78F2A1078}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85C4F~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21011~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E777E~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D98C~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0D04~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4F61~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B23E4~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F1B3~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D8FE~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7847D~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\A5D185~1.EXE > nul2⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3412 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD58e67556cb027f28af3afa731c4e8e2db
SHA1bc77c644fbffeb1f52e5d9e00893e2a06477c2c5
SHA256e222d7465897ea0d6223a70a888aac16a03a791cf8635b875d973d930536357b
SHA5126e88dd935384ace41641e5d4bd8aa1903b16c65f72235a599817e102bcb1dfb2a16f1a748bcd57e62d6bf39cc9d07978c8de4b11a1a0e305531a416b4bab5053
-
Filesize
60KB
MD53d1b5b37df82b71bcfca5ef3bb901e18
SHA178d65efd639baf55fe504c090a9302a29af2f520
SHA2567bce2c02137286fc1f26b4c2271906ddcdbbd197a977a71b953b6a5b35f74228
SHA5127112d9bb149c944601da6d25d2cf4e97ea05cc1a1a8786da3ab336f3da0265160aecd29440997447befbbca6aae11081affcca7bc7b232e60f56bfd90a65310b
-
Filesize
60KB
MD57ae1e65266e62b4d5c0be5315432155f
SHA14f88cf2b9465d25597ba841a6dbb33dead7d89e7
SHA256422d0051ac60586433d493091ee4ada971f2667c85302852081efc1ca2975740
SHA5123778978a276706955d6f55e0beb2b2db812d5137a7cc5b59eef8804cb8f13f180b8007ea2118dc310ef35d33f5b288f3b50ed655fc0a2328f2fab02cc5622782
-
Filesize
60KB
MD56dcbb1a9d7fd687d131a22e1b4b056ca
SHA1cee3def4f0d5a69df037e2121264f5434d824897
SHA2561a70c69ff6be0ef0e483a7edb1bf7834281475c456b9e316255bbad4843af271
SHA512d1d60d7a65d9f181aa0a7f64116bdd9896efc65c0d77bfa36fcdba96a3cdb930b6e5e4a7e3d035d239ea5889920c63c9cb11e8e2d66e72bef724c8e77b01b752
-
Filesize
60KB
MD52b1e7110a796ba99d1e7688dd3aee03b
SHA1fe81663b414082b7cdb15f0463aacecf0ff346e9
SHA256cb52defba6894d2d139ff7b5a5834e5d4b73d1355298d573ef2361beae579ac4
SHA512613e40c3e0ac9aacefcc9f4e035610ce366cea7aa29a6087e4f3b89402fe0e80323a898c204015ab878abdb1f9f0429a6c8f2b5dae3eb284146a40f683c00222
-
Filesize
60KB
MD51cb94ee51f45989bf9bf51f81edec9bf
SHA1bf5371127e9d9d22f47dbf81a870a41d499da4c2
SHA256e8f7aff6ba81855be2e5dfc77bc4492afce88c670069bf027efccbb732fa0027
SHA512b53d49123a33e2a40f6a5d42d1008417eaa8201e799505784ae2b1dbc2aa98c05fe95726cb1b57f7cebca5c47932e903b41454a0d4acf8c39bfebbd6337bfddb
-
Filesize
60KB
MD5648662ffbff37e978957b0b07f6481c0
SHA10792f45fdd8351a77933df0b364bb1b0882d6860
SHA256a209349cf77513fa148890d99aed8b1096b1f9865ae9b00e82e920d15735617d
SHA512f36e0a711ccc698c56b8667a54218b3af2a737e6bead46449a20b310b428addf66ab6913ebe448ae0529126481f3cb6e02e2ba106877ee3003fa03030c86d8eb
-
Filesize
60KB
MD5d82be528738dbd65e72871626497a8d9
SHA19bfea2eb6129197a5c9337521aa9d638f9232733
SHA25658dbbc156d431aea3f8e2cebdcf8309d29db65b4ca2c7492e038b6e8b0c9a116
SHA512ec6f1352b0b65ddb1663a417c5f0baa2457ed30f9fb290cf19263adec7d7d4a5039e73e28612fc211ec301779230af452bde7d3d3aec9e07eed3fbd6da83a5e3
-
Filesize
60KB
MD5a69b85309a4868baf4ce2e209171c618
SHA17fd239070c8d2e8f7b18ef9b2dd39b0f1a2c1781
SHA2569a6bf088a667ed26a634e447efc79a383d6928497447c685fd1f1b734797b665
SHA512ff6ff2fdd4cea03ca6dd9e67db54257ede3b79b965bf050a9b6066adcca0c661ec0d303a70d6bb651882b70626dd640d0dbb713df91e2cc86a31051756a883f2
-
Filesize
60KB
MD55e5830d1c2b30ddc71771cdbb8ebec93
SHA17d19784f29a570c0a024e25183b0c89951ba35df
SHA256781c11e22ca87648d85c52c92acbc27b00197bdeea6e599351040976cbecce38
SHA5121636e17fc960bec2e5e5288a55c1303e1b0c967f224548800345b0f6f99eb6abb33d29d396b160b65391afad8002a24f597004f67dbda79ba44f3b1e1fc1b646
-
Filesize
60KB
MD52ade3c8764ef9a8f25f52d3eceb6a446
SHA18d340e2d9e3a22f31a600a8e6b6ef0be889240a9
SHA2562f94a0e0a3ee89ab227ad74ef1925e60d6dcbafadedb083179e56502a1bb3f65
SHA51214fe47b49154777fd7f14119372dd32cf880da03d6b698ee33e592313c95fcfd12238c7f761d8dabf52aaf333fedc296a4e988a9d052c1c3ed5bab31147e946a