Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04/06/2024, 23:30
General
-
Target
7c9c4b313ffa65e47e5164d200443edfaadda2251434b1119e33a93f9f2ea217.exe
-
Size
64KB
-
MD5
08c3b4aca7450472fd173763c12ca1bd
-
SHA1
4184657727c108b799211b95e116292a05b2d42e
-
SHA256
7c9c4b313ffa65e47e5164d200443edfaadda2251434b1119e33a93f9f2ea217
-
SHA512
eac1cd17b4f99ae34b9aa3d7f95e5ed057f9f75b4c6a5dd8895a5d077e93a85541d707566aaa2fac7ef7754cd9481ea489c2b130b29134ffcaf4d0d111c31262
-
SSDEEP
384:ObLwOs8AHsc4HMPwhKQLroa4/CFsrdHWMZw:Ovw981xvhKQLroa4/wQpWMZw
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 36 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c9c4b313ffa65e47e5164d200443edfaadda2251434b1119e33a93f9f2ea217.exe"C:\Users\Admin\AppData\Local\Temp\7c9c4b313ffa65e47e5164d200443edfaadda2251434b1119e33a93f9f2ea217.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B01994C-D619-4120-AF07-59F9D0195C95}.exeC:\Windows\{2B01994C-D619-4120-AF07-59F9D0195C95}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DADE67DE-8198-42bc-880D-960B9B475B2A}.exeC:\Windows\{DADE67DE-8198-42bc-880D-960B9B475B2A}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36F27C5E-104B-42a3-815F-5B86F4B43B88}.exeC:\Windows\{36F27C5E-104B-42a3-815F-5B86F4B43B88}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C62FBEBA-F013-4dd8-BF0D-E09DAB362C90}.exeC:\Windows\{C62FBEBA-F013-4dd8-BF0D-E09DAB362C90}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80E84CCA-AB5B-4629-B1E3-3488B2C3CF8F}.exeC:\Windows\{80E84CCA-AB5B-4629-B1E3-3488B2C3CF8F}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AEC1FE8-38E7-4800-811F-AA8F765E50A4}.exeC:\Windows\{7AEC1FE8-38E7-4800-811F-AA8F765E50A4}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51338811-7EC9-4c59-822E-0351B6492C0B}.exeC:\Windows\{51338811-7EC9-4c59-822E-0351B6492C0B}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D782D85-64C6-41de-BB5C-56243335D8B2}.exeC:\Windows\{6D782D85-64C6-41de-BB5C-56243335D8B2}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93586E35-5068-4d57-8E54-FF22D31EFF40}.exeC:\Windows\{93586E35-5068-4d57-8E54-FF22D31EFF40}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7AF31A47-BC1A-496e-99D0-90DBF0D08920}.exeC:\Windows\{7AF31A47-BC1A-496e-99D0-90DBF0D08920}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23325F23-A836-44fd-8F6F-2A87318AF36D}.exeC:\Windows\{23325F23-A836-44fd-8F6F-2A87318AF36D}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{73A148C5-01CF-4eb6-BB0F-DC60301CE12D}.exeC:\Windows\{73A148C5-01CF-4eb6-BB0F-DC60301CE12D}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23325~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AF31~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93586~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D782~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51338~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7AEC1~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80E84~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C62FB~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36F27~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DADE6~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B019~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7C9C4B~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5993a429961a553741913351eb3bc1d9b
SHA1c644010db3c7298c1a7eb1eea1b1bebafd0af003
SHA2566803ad48b2c95218b040678b6cb3f59cd94980f79de5fdd398eae99ac998f98b
SHA51200a420ec7604b30ade110b8b35ebd509f309b42de1983f9256fe703bfcc133bf8198e7bb51d7a98036c313aaa11f6d304fa331e73d88586fdcbacf8d200f10b6
-
Filesize
64KB
MD533b7c09f3dfc77fbdb0a86b9f26efa2a
SHA1476b8a441c30db88a29de644caa4dd082474e39f
SHA2566df8d0c219f83ea8ecec5a2c6534cfb7f1324cdcce0b85d525e537e20bc02241
SHA5120c7749d15e8afb133165da5f7caed252b367b4624f02c9c945c8716b59fb81938ed4b36ebf7f98d4e58a1d43eb0f0559dfe397db1889ad82f16708de7d2980e5
-
Filesize
64KB
MD506cd110a341db850dc346230a8d77915
SHA13af17a09196761040ee3c26eabf5eedfe0e5ec78
SHA2569289e9968ce4acb9e2a935afbeb24680326d60e4518c27663b4266353151c769
SHA5125f66503ecbb13089445c61d6273c72eeddfab89b40910c1ec8e4e9ab578b3a989fd03cb0ac1867f0cbe1d3c3016f4233c312d8e39057988738978956a47f12cc
-
Filesize
64KB
MD53e212e462ab8e101a07a62d57c9caf4d
SHA132e9e706951366cd2f33a02ce60ca1fd4e1e41b7
SHA256fb4078fd02fa0b5ca33c7c035e178ac59660a7b8f77c3c47a2224cb6acde093e
SHA512e7cc45901e61a55c771bddcff3504544dee8ead866c381c501fe1671650ad5964ee2e57f7c6be255a822ae15a352bf1ff40f08355563846cc82ba443c097871a
-
Filesize
64KB
MD5cffe8afb01c7b9536ef30c2963357d3c
SHA1f07356e770d6febc99cba2438678d645b105fc97
SHA256f21a7cbe70c95146377dfe657939ee38ca8a2a173be9819f9f7f87428e978f8b
SHA51226a985c75d6bfed925859fd270ec6d75a8569b411d77dabf3088921ebd657a1aacb30f2c149d0df9cbf17328c5d5e7cc74edf589ade299884e415b12566b4e7c
-
Filesize
64KB
MD521620e187a3200f9a3b494decce6cd09
SHA1c86f3cc38f6008b2ab32e27acfcc38bda149a1b2
SHA2564f363af2cd23f20cc91cc00f768c0887ff38793799c5b118f6de973d33fca93d
SHA512ceda3a1bfbabbf6563823bc9b8daa5ae4dd8c95f020241b9d555836fdf1a7d7b402a91e46b4957c290156899c5a6e87cda2ddc8a5684bd8f289e6152fdce37bb
-
Filesize
64KB
MD5d9abf0c9a3f0fa14f5b1cddc7e1d651a
SHA1b7abf322e79ff64b014612966050c5760717327c
SHA256883c20baea4019bf27a35e0d7085845553ccb53ef617b39998a4e3908e4fb507
SHA5129e82150c1dbe66221716624e275d740e7cb9e56385a338e7678bcfaf4102f2f30fa3cbcc9cd5be161634120d38191f29710e92cb9c8849a272e94f5deab4c1de
-
Filesize
64KB
MD56e4020e46a4f20856171c33a7849bd4a
SHA1b9e93ff4bdf7ec11ec28e6a5483f3fc18201d8fa
SHA2568e48aee03c47f08be11357943996ba148bf3279d2923b1e348d9de9adff99120
SHA5122f6617a1a942b01e6e517ee134925202104e68f8e55c4dd64b57f7750e195a5852cf4e6a631b4fbbb593c3d8f2f5848ee41be02117eaad71520b3cd17b074e19
-
Filesize
64KB
MD5f52deebb08a936a0021272e38464fc90
SHA13903e77407df14506f299db6403e0eabf1df0486
SHA256b90762d1bc65176223b019d54f7197fc866e60575ce6ac9ff20fb486606ae1ce
SHA5129667c971d72c44c0b518e8c8d9864dbe5a49edba654f46dcb465432dc4596069583f6e7feeb79ca1f3ff4b57e7de7b4e8c3db7619bfa2b49778f3ac254e9aab5
-
Filesize
64KB
MD520f3c725fe4af9d9d5020d553c826f0e
SHA1e8d6a7af3b5f99169eda882bdadc4458b185cf70
SHA256e702df7bd828f63319688f28f7178c8c868eac40a00146545312b28887290de8
SHA5124d7fe72f17b9c79094c8606bff953803d3b862ffe95fb5ed0fadcc1ce29290cee2bdfdd9c75dc117372c3a6a30a0ffc0cab20ed1d69651b47ce2a73d1fe8d517
-
Filesize
64KB
MD50bcb578cd91e5e1e4bdf0f89bd8775a9
SHA1c00869b5d9f49de5f688533aa46b45c080958eae
SHA256de3a385c5215f48400214896a84d2cb9baf0fa7de5d4936ac0e8ba6daddf17d0
SHA5126f8bead9051fe7e6fa724a75ea7ae5a0b83f0ebaaac1bd0f38387d0cc541b8940481c033d90e95bfd5128e142a4546a84cabee9579883f62834d2d89307f0ea4
-
Filesize
64KB
MD53f4e7e1b1f4e0a754d09dabc6e9d5caa
SHA1f9eca01c27bef6bd4a0f1110140ef2722b9fd814
SHA2562311445e4e052be9cfa3cc6427f2bdf772abbf744e21dd85967974ad1d289288
SHA512a949df1cff73ef931a38911f5c075a7063c8465c15623af08c4f4b4a6a7c572ca91e41deea4fa88c2cdde1ec47ef68e433675bc7fc9a355941cc2ba8a3a82b7a
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB