Analysis
-
max time kernel
148s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 20:28
General
-
Target
1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe
-
Size
12.9MB
-
MD5
f2b2e465c87336bcfa9031cf67352d9f
-
SHA1
205393c0440366d5718306bf355d2d0057306a6d
-
SHA256
1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc
-
SHA512
abbb8f0c303dadaa445651f26dd156efb118394942464dd10a56e8947ff5c7cd5d687d0017195d47c2b6baff3e8bf559f143d91cabe4cdf70f038dbfd9366936
-
SSDEEP
393216:skp4W171LyjG920082mFFE5Z4xLZbji5TQ:8mpLi1uNdsTQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe"C:\Users\Admin\AppData\Local\Temp\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\92pkÌìÑÄÌؽä\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exeC:\92pkÌìÑÄÌؽä\1066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.9MB
MD5f2b2e465c87336bcfa9031cf67352d9f
SHA1205393c0440366d5718306bf355d2d0057306a6d
SHA2561066eec974a49a38c6926650d2a13720a61df1e3be7f72fa46543e1e9fd2d5fc
SHA512abbb8f0c303dadaa445651f26dd156efb118394942464dd10a56e8947ff5c7cd5d687d0017195d47c2b6baff3e8bf559f143d91cabe4cdf70f038dbfd9366936
-
Filesize
102B
MD50bfa03b69330413e7867e14c06f06074
SHA12910918c4c59f341f696d4b3482268e8d96d5976
SHA25683477dbc7b6936a19f2b552b07439612caf781fdcda189582a1a127a11960926
SHA5123b39a2c1b233db8a0efed8fac31b8989424b27c825608bbcbdffaf5644b2dde735da2d3742fa396a444928c16233383050d03057c28745cc73acd3fd89ec508d
-
Filesize
16B
MD57bc1bde1478322d5237e89b121ea1d3f
SHA1fcded47249c42cfef574d2f085484a1c7f5ed51e
SHA2566b48814c42b8009c986f97ddc2f9b92fcd60a64eceb850b362228049d2bebf75
SHA512cffdd0409d760e1f12d65a8a003e77323c366a94175ba89faf0468f8fac0e44f7bb6866980f21f12d5b5f45dd131d4eb54a6baea8131b8a700305779e626bdb9
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
3.8MB
-
Filesize
3.8MB