Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
28/06/2024, 04:49
General
-
Target
facbc91568afe24ab6080a47e592ba71481013419a416d43fa756468cd2e6f8d.exe
-
Size
741KB
-
MD5
75d176db8d849ee2e3c3e1a2b43ae810
-
SHA1
7ff10a516a999417e61e3f83b64fa55cce33a94e
-
SHA256
facbc91568afe24ab6080a47e592ba71481013419a416d43fa756468cd2e6f8d
-
SHA512
69b4b44036718ae35306420224cddce9421c024d2555a47af7d17004268ee422d67e18cf2b66496f98392e76b5ebfdc68377e8b5de86bd57105fb6dd2025b84c
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1FK:lIt4kt0Kd6F6CNzYhUiEWEYcwi
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\facbc91568afe24ab6080a47e592ba71481013419a416d43fa756468cd2e6f8d.exe"C:\Users\Admin\AppData\Local\Temp\facbc91568afe24ab6080a47e592ba71481013419a416d43fa756468cd2e6f8d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5b9eb8f336c4b193b28c273e82566b6fd
SHA1f6112123ddb67c917ef10d6f4a0823faca08cb0e
SHA256179adf538c9bb353f0baf417ba5454120c10495370664f5bd438903fb7231a08
SHA512e1058563831f5014575d4af68c0d0738c2a524f07c63dea4186caff2a41e959c87515186cc5c102cd08083a94b139471ba98855f8bcb9825d8bb6d4f4c23d9f0
-
Filesize
741KB
MD55073cb98f15bca48ca52e33268431110
SHA1d338e08ec53fe4cf4ba55c4cf8945add0c952eaf
SHA2567c5273cafb05b76ad9c31767b70a049d5b3812756ef2264e6ecf18a14c89ac11
SHA512aeda008db25be5de304036c7da08d6175654571e14e21ae0794096cc260660b044a8f824550916cff983d6114f6f2a032d2c6e86b710d105cb55326dbe8a3962
-
Filesize
741KB
MD5d96a081f595d9c2b29c9887039069831
SHA19f5d41066f8d24c7e55179e34353f0c797d6d6b1
SHA256a8bcf991a0c223ccdbfa8c7a08cada3089cee6002cc597132bdd32eefc036e72
SHA51241d2f311ad53e798d3bef19e4c344eef4ea1be93460a7191ee8397741d8f5724bad7dacd51f19275f8bbc64a39029aaa8584f13bfe5ad536e2089f1bd6ff0821
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB