Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
17-06-2024 02:09
General
-
Target
c7c6b5398c5411835112fed2d4169c76f07f4850c920d17f692df14aac7fa3ed.exe
-
Size
741KB
-
MD5
1d27448a1cb8c95ab3839ce58cf1c469
-
SHA1
2fec19da397b24020835d821b4c617c30172e06f
-
SHA256
c7c6b5398c5411835112fed2d4169c76f07f4850c920d17f692df14aac7fa3ed
-
SHA512
0c2fc5e27009ffebeeb201473ee155bf21648752954a2e1d6b8d651c008d94f3cea1ad678f8bc2fcd3d8c1f00db9695e90ee0a6b3c7c4053c51718c245046dee
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fc:lIt4kt0Kd6F6CNzYhUiEWEYcwU
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c6b5398c5411835112fed2d4169c76f07f4850c920d17f692df14aac7fa3ed.exe"C:\Users\Admin\AppData\Local\Temp\c7c6b5398c5411835112fed2d4169c76f07f4850c920d17f692df14aac7fa3ed.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1300,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD5c6f87bd897d03a8c181d255e3558e516
SHA1b3ddcebd4b8e9e54f9b8b7d58097e03c4eb6fb0e
SHA2564122af6606fd5e6f8089ecd121a88acd4b30bd286d6fded6c3ba5bdb804ac4e8
SHA512acdb15a452226a2fb3d6253f364b3790a016e2f11579c2554e7ae35bcb14a0af3d3d87538dae980d2a3c975b955200006527d0e92213c4b46893cbf7098dbeee
-
Filesize
741KB
MD57234a2164d748862f14fb100249b0dd3
SHA19f49dc47e856344367918419704f3837e77ddcf1
SHA256383e287788d0c80169f89a1d10678af3f9dadb0925e0f70496bfdba8d802782f
SHA5124df28ff87bdd3bbd5855d81835a0e82ada7d942506321d4acdaf2cf2854f61c90a2415a5aa87af9f0e8a6d611151169b0f1325eca6d8f4847c3aab1b970ffff3
-
Filesize
741KB
MD5520237dac5ba3a29252013c52b346917
SHA169d6fa36df1000bd79b70c32d421244d679f121f
SHA256c4b28679b9588156c10ced3b5aee5651ee490250e214d1fbf00acb62d33b4c00
SHA512bd19c66d211100f86ef67b823438bc30b63ce3c545d343c8ddeaa2dc74ff4483aa3c8e5f6900d3e8b04360cf9b810d1653b006b1e7ac7a630b2037f9dc6e185e
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB