Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
01-06-2024 14:23
General
-
Target
Voltra.exe
-
Size
20KB
-
MD5
e40be8474ee87f288835e78208afdc49
-
SHA1
aa0b4ff63cf2116f5637e0e61fe9815c05b19afa
-
SHA256
46f93b71babb83aec96d20310c63070103b45191180cfc43b1208bbc10f928ff
-
SHA512
0ea80ff9199dfe1e4c5af073d969cabebba67f4d116379c50ad34efd6aa72e4cd5fe768e7e4becbf43bd25ba9655bdffc514a83d426e86bff41d888f00febbaf
-
SSDEEP
384:50utpy7gkI1QhONkup6+GHFnVnCKd3E14j+adX/lrHdPec:/x1QPM6/iUfz
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Voltra.exe"C:\Users\Admin\AppData\Local\Temp\Voltra.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3104 -s 27602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 3104 -ip 31041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
7.7MB