Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
23-05-2024 20:28
General
-
Target
1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe
-
Size
12.9MB
-
MD5
f2b2e465c87336bcfa9031cf67352d9f
-
SHA1
205393c0440366d5718306bf355d2d0057306a6d
-
SHA256
1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc
-
SHA512
abbb8f0c303dadaa445651f26dd156efb118394942464dd10a56e8947ff5c7cd5d687d0017195d47c2b6baff3e8bf559f143d91cabe4cdf70f038dbfd9366936
-
SSDEEP
393216:skp4W171LyjG920082mFFE5Z4xLZbji5TQ:8mpLi1uNdsTQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe"C:\Users\Admin\AppData\Local\Temp\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\92pkÌìÑÄÌؽä\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exeC:\92pkÌìÑÄÌؽä\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102B
MD50bfa03b69330413e7867e14c06f06074
SHA12910918c4c59f341f696d4b3482268e8d96d5976
SHA25683477dbc7b6936a19f2b552b07439612caf781fdcda189582a1a127a11960926
SHA5123b39a2c1b233db8a0efed8fac31b8989424b27c825608bbcbdffaf5644b2dde735da2d3742fa396a444928c16233383050d03057c28745cc73acd3fd89ec508d
-
Filesize
15B
MD552dfe2623e78235bee22eacec89e9cb5
SHA1a9eb230a0219e4a2f1ca32daea53be0004fdbf8c
SHA2567788dab66c748e32a563d51dc670b20b351c493653df3493eb7c760a71cff9d3
SHA512b308e3dddb17c740f797eec32e6dc049e0f3f49a4cfe985cc5f7f9a26009cda975e6529d03b959be0d550db6aaf377ecac1662bf2e7ab3e24650e14fc828bd71
-
Filesize
12.9MB
MD5f2b2e465c87336bcfa9031cf67352d9f
SHA1205393c0440366d5718306bf355d2d0057306a6d
SHA2561066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc
SHA512abbb8f0c303dadaa445651f26dd156efb118394942464dd10a56e8947ff5c7cd5d687d0017195d47c2b6baff3e8bf559f143d91cabe4cdf70f038dbfd9366936
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB