Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
08-06-2024 18:16
General
-
Target
03a2cf48ea751df6fd076c5a620b223a61cd050d44a932c25dfdb2fe1ef61498.exe
-
Size
64KB
-
MD5
01fa4792e3df2f4e2452e6dd3fac8fb9
-
SHA1
571b92ac5c787394f2d3e458cb179b9677b06b60
-
SHA256
03a2cf48ea751df6fd076c5a620b223a61cd050d44a932c25dfdb2fe1ef61498
-
SHA512
2d3337a1db7813c8ac3e97a7dd0809d942b274041b6e924f29bef2038cb1f20b4c25c2bfdb954185bd3d9429a868ca244a818f5174c146d626f608854f132108
-
SSDEEP
384:ObLwOs8AHsc4sMfwhKQLrov4/CFsrdHWMZH:Ovw9816jhKQLrov4/wQpWMZH
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 34 IoCs
-
Modifies Installed Components in the registry 2 TTPs 24 IoCs
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\03a2cf48ea751df6fd076c5a620b223a61cd050d44a932c25dfdb2fe1ef61498.exe"C:\Users\Admin\AppData\Local\Temp\03a2cf48ea751df6fd076c5a620b223a61cd050d44a932c25dfdb2fe1ef61498.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B07434E5-6096-4765-9C66-7333E6CAB139}.exeC:\Windows\{B07434E5-6096-4765-9C66-7333E6CAB139}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{834CDA16-C992-44c0-BAFA-85B3863F2E5E}.exeC:\Windows\{834CDA16-C992-44c0-BAFA-85B3863F2E5E}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F270767-DC9F-4b2d-84E5-6228D384AB2F}.exeC:\Windows\{2F270767-DC9F-4b2d-84E5-6228D384AB2F}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A2847F5-9916-4d5d-875A-87BED98041F3}.exeC:\Windows\{8A2847F5-9916-4d5d-875A-87BED98041F3}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BA2820C-CE63-4491-A732-B3052971735E}.exeC:\Windows\{3BA2820C-CE63-4491-A732-B3052971735E}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D40690AB-D558-4166-9157-59778610B68D}.exeC:\Windows\{D40690AB-D558-4166-9157-59778610B68D}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{126BF2EB-5E02-464e-8F4F-F9D699F231A5}.exeC:\Windows\{126BF2EB-5E02-464e-8F4F-F9D699F231A5}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{696DEA22-90C6-465d-B7F4-1CAF56F8CD62}.exeC:\Windows\{696DEA22-90C6-465d-B7F4-1CAF56F8CD62}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4070BFDF-65AD-47ad-A7CE-C23AA20685D1}.exeC:\Windows\{4070BFDF-65AD-47ad-A7CE-C23AA20685D1}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61FA9449-7C40-40f5-9FF5-BFAC814E2659}.exeC:\Windows\{61FA9449-7C40-40f5-9FF5-BFAC814E2659}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99EB5980-FC42-4d4f-A093-13CFD1BF74BB}.exeC:\Windows\{99EB5980-FC42-4d4f-A093-13CFD1BF74BB}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3CB5323E-4CE2-44bb-AC7E-D1A7FFFC8613}.exeC:\Windows\{3CB5323E-4CE2-44bb-AC7E-D1A7FFFC8613}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99EB5~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61FA9~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4070B~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{696DE~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{126BF~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D4069~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BA28~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A284~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F270~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{834CD~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0743~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\03A2CF~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD592766bf934dd301fbf9698d4d05e9148
SHA18ae93419e188c12726b6a3ae739d5af20b5e9eb4
SHA2564fc2503e7f448aa6c96d9a2a40a4079d05dff47ab267c5573678f3b028a2dd74
SHA5126dd7f59c81f33ddd83b64d745c87c2e68254df9b99019540f0889c325e0624cd33e1098c6daf9ca1f20bb32cb0db4c8702bfac0f13e11eef37ddeb47b99b1a34
-
Filesize
64KB
MD524c70ad2c5b1f895ced6676075845132
SHA15ed8c18ca0e88a67c8f6f3a6450df124500ef4c2
SHA256290454cad443747f2cb08dd704bad6f9c4b99258cca054e655c2fc7f9b2ccb63
SHA512b7a7d8b5e509a7eb0768fe3c4edf0d1c51578ff79e5786def2275ba09ff04081d01ef41f0cd82f646374704c6800314f2c21c3f2e8e12b4bb9d40724bbfd0d58
-
Filesize
64KB
MD54353e302ed93843e70650021caa40dea
SHA1ae710094288690d7e8bb3f0fc8fb47a33d7a84ef
SHA25663cdd79b74723281cf356086fcfe69d2aa95ae585131bb6ce07244aaa0057cf8
SHA5124ba3504fe2db56d0faadf2d6509177235aeee9aa43d3e6e740e317c1c421e842f5e4b6301629fb62dbf50da9c65756541231f79e64bd84e1f8c26034b5346ecb
-
Filesize
64KB
MD5a2cd0e213f44be25563670c6022d6b13
SHA1f03ab63d1247f30ef1c4d5973949a7f4dc18c8e0
SHA256fe35846afcf21d9bc4baba35e14d8351958d16ff1fe4ee41843650c2b9cc6b8f
SHA512affbac3e10696dd16d7675bf88ca78d43389bb6b2ec6477149838d5e6db34c2d7461e9361f9dccaf476b15a6d0fdf7e27d510054215ef6b9f374ea8c902a5124
-
Filesize
64KB
MD55cb1869abec5c0917841ded6059e0314
SHA1c8a9263a395c9c46026198909bdc7568a59c0483
SHA256feb7662901fab934ce1a4b67c7bf2d83746aeeaa3d2a35035c96490d27c269b8
SHA51224c4aa55b6ecef34f96f1900a2e6ad1912c593cf05b8b0eb32373225eed0cbc793ebca54315618b880abcdfc37a30b14eabf4a23d0c29ac92f71ccd78cac6fde
-
Filesize
64KB
MD54da6e510943b0e9fda7d5d694430b63f
SHA1640fff596de78d8ab57269644ea5f208515a821d
SHA2568fe1ad63ca96d441d604262925c9cc216b83bade0217d9b9210b89def5964723
SHA5120c77db0caf49ce260fee929beb06185c82fb6930a0c920338d49fa0d8d3c98754934a97f6a9747e3bc21f1daef0c666189406993cfc749eafa0dae28168005a2
-
Filesize
64KB
MD552f7da7149b9740a80e5252d76bbcf7f
SHA14ddd48ae5fcfd02822f6c0b4b91cc1f3dd606237
SHA256bdbcfd425626d670f76a16b6196eb18684758cd886e8cc4475ce3611058d9268
SHA51278e6b4e5ed4b45f3f289d46858e4399af6f4e62d276f3f29590e6fe5c8ed266b16b6ed4e8ece4c9568dcdbca886862a836ee27a68e1e1c307abe0d7a11f358c9
-
Filesize
64KB
MD5d1caecddc073042def284dcd23ec11e2
SHA134ba97d8d38a078e065ac7521e4f80edc6d76b6a
SHA256aadd3956cf8e3aeca16dc6118fdde64b95ff8ec2515e27eb07dfad30c0bf585e
SHA51294707b520e8a88911479e25962101c2eeb38f018a68b72f2650ae97561bb2ebd5dcd381cc19651b21e49dc9354dad744b26fbe257640c5f2fd0f90a9409c834f
-
Filesize
64KB
MD569548177c462de0eaa017ce0aab816c5
SHA1916aba7882e47b78c756737cf9ba82f8f7884854
SHA256aa20c8327bd2bace50352e843f391d04d34b3c8db8d7105da03f6d60a228f7c6
SHA5124d529ec11eaf930af7d231d2c7577832cd083adda9c4bdeb0852c73c292c93772b0f6dcfd06575566f0edd6fa63c30a649261be67132bed46e299900148c9697
-
Filesize
64KB
MD5532776d3364435189cf66e3725b126eb
SHA1e36ad6b4ee39cf7286d08508664c8792440282f5
SHA256e45b565bdea6e2e91b76d66edd75ee0891e369007b159534e572edde923d3bb4
SHA512ff2305d64573eeabb49dc70a13915233d2326d9bd2731e3e605d3948144212cbca7cba273ac22885ad07f4ff3206b7a3b25e6c551335beb859e47b02ccc6611b
-
Filesize
64KB
MD57597ee4b23428d672a0649932966a519
SHA175db464ac7a10f0baffcb6c9b0d15ec2504c6b86
SHA256b7fde3932c9cfdacccdfcacd4b3c28271f7ae101bd966c258a2d698527e2f2c1
SHA512672438fc129fe4f1f7c4fc4b92f420fdfd30416d4cf7e197e1f9d8954e8e47f1ac5ae3daf719f4411a365f0d66b925a28fe045d0826f486e1ce4dc94f4f4fa8a
-
Filesize
64KB
MD51db71168ba2ae6d086009688ddd1c1ce
SHA14076ea3094564a5b1b09577707c4ff1950ddd145
SHA2561d0d66777ee929daf333eb6a34090c20188ed23de33fee1ffc2fb9146c7c07b9
SHA512b75b18a383617a4e19f78fe4528edfd528726c75e41468dd289e559fce002d74845b73ff3d5eb1d665aef3e48ddb3b2cc18866fa0d14507cd3dab0b688ce2d67
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB