Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-06-2024 01:21
General
-
Target
fd1f6b4810656ebb45ab675922aa86661b1b15fd0d1c5adeba4a44f7034be5a2.exe
-
Size
845KB
-
MD5
7ad1909784bfaf8170b36e0f5f98d79c
-
SHA1
d02a1a962abd114639970e4e10cccc6a3815c9d6
-
SHA256
fd1f6b4810656ebb45ab675922aa86661b1b15fd0d1c5adeba4a44f7034be5a2
-
SHA512
a639e56aab9cb7d93edbd1edaed6a58dfa3bcf7223e0fc30643255f4e9ea7bc593112678c40d5109f2bf6ae92e977aeb605ccd9ca0183b814cd14058b3443212
-
SSDEEP
24576:kWS04YNEMuExDiU6E5R9s8xY/2l/dzuIbt+rk:ky4auS+UjfU2TzuIbt+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 36 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd1f6b4810656ebb45ab675922aa86661b1b15fd0d1c5adeba4a44f7034be5a2.exe"C:\Users\Admin\AppData\Local\Temp\fd1f6b4810656ebb45ab675922aa86661b1b15fd0d1c5adeba4a44f7034be5a2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
845KB
MD57ad1909784bfaf8170b36e0f5f98d79c
SHA1d02a1a962abd114639970e4e10cccc6a3815c9d6
SHA256fd1f6b4810656ebb45ab675922aa86661b1b15fd0d1c5adeba4a44f7034be5a2
SHA512a639e56aab9cb7d93edbd1edaed6a58dfa3bcf7223e0fc30643255f4e9ea7bc593112678c40d5109f2bf6ae92e977aeb605ccd9ca0183b814cd14058b3443212
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB