Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/06/2024, 18:51
General
-
Target
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe
-
Size
83KB
-
MD5
9632e7941853f0533aa1de7522fbc5f7
-
SHA1
6ce7284b526b08c7b5f196bb0c5a4ec7530a20d9
-
SHA256
09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386
-
SHA512
e4f11963c2bb4175c99fc352edeadea1ff23c0eca4588bd236ff6fd2d244bda3ede66af92eacfb1d364925134ca4fb6d305fcc259095068f3aef2e96982f3cab
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOoMl:GhfxHNIreQm+HiTMl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe"C:\Users\Admin\AppData\Local\Temp\09f439a6bb38ffe09c2428df06fbf0a4ca2aa138e922653ccbed8ccbd1512386.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5c6cb55339cf96da38bd0c8ff5ee34123
SHA10490bdf73334cfb70934dfbe8df98688d3eabedd
SHA2563fdadb4ce5ddb0c761f838ac313e7d3ce962084ddbd5a3a2a2258aa181745d1d
SHA5120b521c3b947838eaba601b4f38b3a951043cc657ded78cf7a32fcda762e385721dfdcc22973afc78c6730a6cc64b3dad0c0696e9ecd549558f3df6bd3922bed0
-
Filesize
77KB
MD59ef7364496bb730d309f5c93faf65e89
SHA1402ac06707ca4a7c5886f1e744fa87195ca98f9e
SHA256c975d96bde208b09a3fcc8d646613a60395df9f17a562bd786054610938990b4
SHA512997e99b1b844cb9268167724ea9eebe6ea0d4e7ff74fa1be058e63ea4d0352cc1245983837f77c7e7bcb341bdf681784b3419cb94230276bd4aa1bb6e048d5a4
-
Filesize
86KB
-
Filesize
86KB