Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
20/06/2024, 01:15
General
-
Target
a0bae41b36563577a9bd12ee8a9058b33bcd345a6fc1b349781b2045889a3b45.exe
-
Size
135KB
-
MD5
ffbbc6836dc3ac3879f1035732338a58
-
SHA1
82809894799cb65da86d398ad98e9e4102308b52
-
SHA256
a0bae41b36563577a9bd12ee8a9058b33bcd345a6fc1b349781b2045889a3b45
-
SHA512
01975b50c0307a5d5c11193a8603f1dffb99e17d8e8b92465ec314e6d6a6936dde654aed9aa88e30e555ee72b68327006071d77df3617a34b3c5dc233499cb8e
-
SSDEEP
3072:UVqoCl/YgjxEufVU0TbTyDDalZZnaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaH:UsLqdufVUNDaxaaaaaaaaaaaaaaaaaaK
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0bae41b36563577a9bd12ee8a9058b33bcd345a6fc1b349781b2045889a3b45.exe"C:\Users\Admin\AppData\Local\Temp\a0bae41b36563577a9bd12ee8a9058b33bcd345a6fc1b349781b2045889a3b45.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD53632cd72c09c85abb768c895b9f327b0
SHA15d566803f402490c4f8216bc645a9c619fede710
SHA2566dc58e5e00dda38b697b953309088660c32b6af71d8b1d36406956069f8b1d30
SHA5122701d26c5dbc4ff2299e8d76846e0683bc37774cb855adbe54d50c10362c667b3c57789d1a1740fb462831174a80935cfa55b1e9a4ded19227b2d014ec71b5b2
-
Filesize
135KB
MD52a10f9c14f59360e7e1be3f1d4045eef
SHA13ac92f03f06577e30169fdb49773f7a734c1f843
SHA25697c42d06ca171f71a143e9a1568e5d3967a9cdad523fd9e91df474b8b391c4bb
SHA51207e21ef4ab96337cda86557be6cd390644a926e32fc60da524279f87b8138a3354f824405dc9860138c5a6f39815700bd15c3ec4257958255a9727f4c9f028aa
-
Filesize
135KB
MD521db6b4056c3d2881f0b05dead9eabf6
SHA1bfa2296d40157d67453a03c9de2747658e83c9ce
SHA2563755a924a6baaadf155e2000b857c37cae063b034527bb0d6a4295d12b198459
SHA51267d6850b4598400f0f3f7fde8f5e7799fd5609ec668ee1ee6bf2214b6dbbef32e9d4b9be1cd3b86e65bd67e45b408a6cfedab64ee71760887dcb6a3b441f9682
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB