Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-06-2024 02:59

General

  • Target

    d23291f2147d341c96ed903a3b79dd81ea2ce32b53d18c59a20dcd7dbe240d69.exe

  • Size

    998KB

  • MD5

    76e503bb6d726fdcde53d47f68ee663e

  • SHA1

    338d1dd9f50b9868c6f88b287d728fb342f6ac06

  • SHA256

    d23291f2147d341c96ed903a3b79dd81ea2ce32b53d18c59a20dcd7dbe240d69

  • SHA512

    880a30e15ef76a22e44d397e30fa1cddca1a4afbd9fb75b64e6780cd1b3ef953455f804736ebfb9cab4433f6046ef50518ca332ad7068e973fbde898fb890d3b

  • SSDEEP

    12288:Ur0UR9h0BN3J05wRWGBgbib5J79QvjlDjMzVkpSHNl2JQ:Ur0URPEJ0sg+9kqVkpSHeJQ

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d23291f2147d341c96ed903a3b79dd81ea2ce32b53d18c59a20dcd7dbe240d69.exe
    "C:\Users\Admin\AppData\Local\Temp\d23291f2147d341c96ed903a3b79dd81ea2ce32b53d18c59a20dcd7dbe240d69.exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    PID:3560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Adobe\ARM\ArmReport.ini

    Filesize

    684B

    MD5

    a367c233ef7971a5cb035e976e4b61c0

    SHA1

    f682772703615d263028229b05729e85a68601ea

    SHA256

    f260b14e67e02e8a2652b91f087dace1a8d991cae835d89f61e1f9b36227e66d

    SHA512

    87b3e9c5ff6bf11407a53e7e6e78799bd936bf5b458378d2600bc298ad2b146c764bbcbe58992e3e6879f09f8f2caf58832d84114658d126697f62c5c2e2f96b

  • C:\Users\Admin\AppData\Local\Temp\ArmUI.ini

    Filesize

    185KB

    MD5

    02a2c53bd88849d635e985274c7ca2ef

    SHA1

    b229a28dfaf7fd1cd5fda4c9cab5828027d509ce

    SHA256

    fd8fa0a723aad8c6f74e05662bb3962a11f16acb13195cf73ea330100a90144e

    SHA512

    e656eb3fe2a436d4cfb5cdaa2de1a5af18acb53e28b74f5f67ac44d95766c42827042da5ea800b67d271452a3151df14f9c5e4a1aeb7a8f6ac0be638b517b78b

  • memory/3560-0-0x0000000000400000-0x0000000000512000-memory.dmp

    Filesize

    1.1MB

  • memory/3560-95-0x0000000000400000-0x0000000000512000-memory.dmp

    Filesize

    1.1MB