Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
11/06/2024, 22:38
General
-
Target
c6efb6bbb11027f44e6fe71b465c88b8d7423da37550a652157631f2977bdd4e.exe
-
Size
74KB
-
MD5
c4ea4a03aa1787ba71249b1d4168fa74
-
SHA1
d86d1a6568dbb8e3a448594005c17c4bcf16d5ae
-
SHA256
c6efb6bbb11027f44e6fe71b465c88b8d7423da37550a652157631f2977bdd4e
-
SHA512
272d2ac847f2d526ce84a7c02c818b44eeae853afb9a65cf7eacb215c68c2d076e368d380199c4a79c435286f25f9d662f75dba3d0560f577954b0e69ded8163
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO9m:RshfSWHHNvoLqNwDDGw02eQmh0HjWO9m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6efb6bbb11027f44e6fe71b465c88b8d7423da37550a652157631f2977bdd4e.exe"C:\Users\Admin\AppData\Local\Temp\c6efb6bbb11027f44e6fe71b465c88b8d7423da37550a652157631f2977bdd4e.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD57cf6b0b6a145c6783430e76a09f4e0b1
SHA143d3c7669d54b439afb101cec319c521855aa6a7
SHA2561979ebc78d746300724087d51464db73016953b885543b32206c4db058dc600f
SHA5129ee35f1f1d39d3d42e2f6d58b7bc765d2075c8d37ad8c5044d5a6a1e466adbe58325ce001f0bab1b8b54c0a9417ac64cac8441b0c5e0ad032a935f83df3c5808
-
Filesize
75KB
MD5bf9563e8d361e3d1bb7636cabe4488a3
SHA1fe486587ff5ec9d8f2e8192b224ecbf6eda74f6e
SHA256b527d961ee9b815a5522de0cf1088af97b601d2fc270a8646a49f54ff8b2911e
SHA5128292ff6065d7b37b5276bb202366e404f9075ab9673e634552b4e0d90e9964b28085bbd3d1d4de8cc62233197c285360e191a6635460ba12a14834c3d250d680
-
Filesize
86KB
-
Filesize
86KB