Analysis
- max time kernel
149s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 02:11
General
- Target b1593416396a5e6db3a43bbc0e156b860d6be83c4ac38b1e2c4c7c1708c7b265.exe
- Size 64KB
- Sample240611-cmjqlazfpb
- SHA256 b1593416396a5e6db3a43bbc0e156b860d6be83c4ac38b1e2c4c7c1708c7b265
Malware Config
Signatures
- Detects Windows executables referencing non-Windows User-Agents 37 IoCs
- Modifies Installed Components in the registry 2 TTPs 24 IoCs
- Executes dropped EXE 12 IoCs
- Drops file in Windows directory 12 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1593416396a5e6db3a43bbc0e156b860d6be83c4ac38b1e2c4c7c1708c7b265.exe"C:\Users\Admin\AppData\Local\Temp\b1593416396a5e6db3a43bbc0e156b860d6be83c4ac38b1e2c4c7c1708c7b265.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6496C9C5-C255-4a72-B216-12898B732706}.exeC:\Windows\{6496C9C5-C255-4a72-B216-12898B732706}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{608BBBD2-9B15-47d0-97BD-4D68AF97F26C}.exeC:\Windows\{608BBBD2-9B15-47d0-97BD-4D68AF97F26C}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B73396E3-D7BE-4cca-8CAD-011DADD52D6E}.exeC:\Windows\{B73396E3-D7BE-4cca-8CAD-011DADD52D6E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A5B0979-8637-4920-9717-F06E1CE7B2AC}.exeC:\Windows\{4A5B0979-8637-4920-9717-F06E1CE7B2AC}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F9FF647-DAA4-4f4b-8D5C-1719B33CCE66}.exeC:\Windows\{1F9FF647-DAA4-4f4b-8D5C-1719B33CCE66}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DC15386-6AE7-48dd-891C-EC8408E23C13}.exeC:\Windows\{1DC15386-6AE7-48dd-891C-EC8408E23C13}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{448AF3F3-8149-4bf9-9A76-4231A4A1B52C}.exeC:\Windows\{448AF3F3-8149-4bf9-9A76-4231A4A1B52C}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C74C4236-795B-4d68-9656-8BDCF1204EFC}.exeC:\Windows\{C74C4236-795B-4d68-9656-8BDCF1204EFC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70A647D3-5D63-4298-8DFE-93B3A8688B87}.exeC:\Windows\{70A647D3-5D63-4298-8DFE-93B3A8688B87}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7AF5FFA-5F41-45cb-8115-BF9AD4F1C5F2}.exeC:\Windows\{C7AF5FFA-5F41-45cb-8115-BF9AD4F1C5F2}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2442ADE9-E291-42dd-A423-10A16BABC1C1}.exeC:\Windows\{2442ADE9-E291-42dd-A423-10A16BABC1C1}.exe12⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{618E7A36-C08D-4a0c-8E7B-5BDB25F357A4}.exeC:\Windows\{618E7A36-C08D-4a0c-8E7B-5BDB25F357A4}.exe13⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2442A~1.EXE > nul13⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7AF5~1.EXE > nul12⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70A64~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C74C4~1.EXE > nul10⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{448AF~1.EXE > nul9⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DC15~1.EXE > nul8⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F9FF~1.EXE > nul7⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A5B0~1.EXE > nul6⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7339~1.EXE > nul5⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{608BB~1.EXE > nul4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6496C~1.EXE > nul3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\B15934~1.EXE > nul2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
{1DC15386-6AE7-48dd-891C-EC8408E23C13}.exe
{1F9FF647-DAA4-4f4b-8D5C-1719B33CCE66}.exe
{2442ADE9-E291-42dd-A423-10A16BABC1C1}.exe
{448AF3F3-8149-4bf9-9A76-4231A4A1B52C}.exe
{4A5B0979-8637-4920-9717-F06E1CE7B2AC}.exe
{608BBBD2-9B15-47d0-97BD-4D68AF97F26C}.exe
{618E7A36-C08D-4a0c-8E7B-5BDB25F357A4}.exe
{6496C9C5-C255-4a72-B216-12898B732706}.exe
{70A647D3-5D63-4298-8DFE-93B3A8688B87}.exe
{B73396E3-D7BE-4cca-8CAD-011DADD52D6E}.exe
{C74C4236-795B-4d68-9656-8BDCF1204EFC}.exe
{C7AF5FFA-5F41-45cb-8115-BF9AD4F1C5F2}.exe
memory/756-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/756-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1400-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1400-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1840-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1840-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2196-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2196-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2264-45-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2264-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4156-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4156-65-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4216-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4216-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4372-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4372-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4572-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4616-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4616-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4656-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4664-40-0x0000000000400000-0x0000000000410000-memory.dmp