Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
26/05/2024, 23:55
General
-
Target
4e703b029b6b30579e9421453b4371745afa31cc997d55c2076184e7b59fd4ea.exe
-
Size
77KB
-
MD5
1cb101ff5c326cd719bfaa18bb59ff3b
-
SHA1
d9da9affb64ff19f52cc767cdf586edff65d1f15
-
SHA256
4e703b029b6b30579e9421453b4371745afa31cc997d55c2076184e7b59fd4ea
-
SHA512
4d83075e79319cfd0d6a6730574ca5ce57b5f42697b08336b90ba443058f1f3bdf458991f7956087382ee47d59d4fa04b726f323fde3c2e115bbeeb6d7f3ee96
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO5m:RshfSWHHNvoLqNwDDGw02eQmh0HjWO5m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e703b029b6b30579e9421453b4371745afa31cc997d55c2076184e7b59fd4ea.exe"C:\Users\Admin\AppData\Local\Temp\4e703b029b6b30579e9421453b4371745afa31cc997d55c2076184e7b59fd4ea.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5a681e7d431a69bcab6e5d1ef21c9e63a
SHA10168d0e210091979a1ab08b313ded1894359d8fa
SHA2561d727d7df8bfd66d3b161d9bbed7dd7239850feabdc58da34abc7e9dd2d4abf7
SHA512486576c6a770c12b475f6cb8ac164b70f8d39cdeebdaa09937bf6e4b19c1ff3983ff0733e1dcb40a8730da775cee5c7a3a19fbdeb5d893f5851084f10e5ab673
-
Filesize
73KB
MD516f2cf080eb7b9371835f671af3714eb
SHA13a762b339d876cb5c05640f9f7dda90c0617cba3
SHA25620dacfe11ee3dcb762a4a920af0c3f6c45f0f5f63a885eacc2e678ea6ecdc535
SHA5122a772d287f7da79d5673dd626ad55b4ccbc260692d008611094f359d7168f9aa49184c2390809020d7da7b3138df24b2f05b8201186959052bd69e45f533283a
-
Filesize
86KB
-
Filesize
86KB