Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26/05/2024, 07:53
General
-
Target
5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f.exe
-
Size
7.1MB
-
MD5
44ed595bdf2594ad908dd1688489e72c
-
SHA1
61979e0087c08d82590f02ebf9cd04246c4a1fdf
-
SHA256
5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f
-
SHA512
b9bb30034bb741ca0512963704c3764914d24dea25ba65b8d9abac08a683fc4cd52c2debedd23576b2069874b379bfacb97768376a4a6a9ea1596f928f96f448
-
SSDEEP
196608:yk/xL+l4p36Iydc1IAxHbG6rjYgMuUR5nPaGd+uh:ykp/6IzeANC6PYgMTXPa0v
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f.exe"C:\Users\Admin\AppData\Local\Temp\5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f.exe"1⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\1.76ÎåÔÀ¸´¹Å\5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f.exeC:\1.76ÎåÔÀ¸´¹Å\5333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD544ed595bdf2594ad908dd1688489e72c
SHA161979e0087c08d82590f02ebf9cd04246c4a1fdf
SHA2565333d7493de096537a2fc3368b5252f4524bc774804a604406e7d78fbbcf6c7f
SHA512b9bb30034bb741ca0512963704c3764914d24dea25ba65b8d9abac08a683fc4cd52c2debedd23576b2069874b379bfacb97768376a4a6a9ea1596f928f96f448
-
Filesize
16B
MD5f1a9af0e457c9653bf7381bfa2a3a91d
SHA19489479df3eb2b39b4f6f820e398f26afc798868
SHA2565636f22be2b859643cc29787709c4c1d17c3ce93ea54b27bc14dc2c7949bdd0c
SHA512d653f5d208ffba8ae5013097ac4ead0634ae0e917912d78400b6e1384957a827c5901510d51689ae9fe369654fc67194e599c561f6b7a76181ab7b9c928dbd4f
-
Filesize
102B
MD5f3594f4fe035be8e6ec25421fc7369f1
SHA1edc048744335ddb5da5dc87366f5108f4876449c
SHA25683f42b50f522f97c8757902e73679deae5902c15d01e14ec071d438543fe7cd6
SHA51295eea911e32dd1c40b5bf985a4b75a1218a7ee4bdf6d4944fab397d92a70f076ab4825fd8d9ff1b83fadcba951d063dcbaa32d4b0163d672a1b2bbf5ba35603b
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
44KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
44KB
-
Filesize
3.7MB