Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29-06-2024 01:20
General
-
Target
aaddcb0a5d7993bd1da7b9e5d999c72984ef571d5cd1269087e5fc6210c60a7a.exe
-
Size
741KB
-
MD5
296d46df103012c3bb0c64bd262b532e
-
SHA1
8409505d00f4356a257ada95e3991a0c828522f7
-
SHA256
aaddcb0a5d7993bd1da7b9e5d999c72984ef571d5cd1269087e5fc6210c60a7a
-
SHA512
1145936f13795b1a549dda2d9f60ef84d131db71db59dbb04710db4cf6f2ee252c0559027b8d895fed0993ae5335e49701768f80e22cd979f507b8209b5aa72a
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1Fj:lIt4kt0Kd6F6CNzYhUiEWEYcwb
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaddcb0a5d7993bd1da7b9e5d999c72984ef571d5cd1269087e5fc6210c60a7a.exe"C:\Users\Admin\AppData\Local\Temp\aaddcb0a5d7993bd1da7b9e5d999c72984ef571d5cd1269087e5fc6210c60a7a.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD5cd78bfdf2bf6678bf518c43cbb424276
SHA1d735fffdef758a6c80787af352db9ae6bf6f8b16
SHA25671bd37fa79a53bf78a4213da521a0cf4bc6ac13d2ca1011c60e449406a9b4938
SHA512f51eb67b44f14bf486d815ebeb0df4c77cc980c5835f65d23aab8f4cede15d3d13cd5029d2f134ca0b76d730837311fd1c334209e1f494f25dfbd50cbe002c58
-
Filesize
741KB
MD5f9b9cdc3d429fafd3a0204af503ab765
SHA1eb7133e94bab9e2470fbddc5c469c92169ca19bd
SHA256320840b275908973112f882cc5d2b2ce3fdfb8372db34243849a6aeec0d6577e
SHA51202708342c21a7f74afa17497fdf6f551466e6431418216d1f4ccd080a45ba594818a92b6b7716c815cd161eae297ca877590b07a9a38eb3816d043b868958d64
-
Filesize
741KB
MD543a413b6b69075d87e78116d50d214a4
SHA113d02e5fd4fa24e1fa508e9ec2d0b80f0a585160
SHA256db1fa6b4efec2862907aa5e8e28ab8dbc6c597a3f2f2ccaa7826de56f006a21d
SHA512fb514e45ede162f8664b59359b7cfb8377215733aaf99b687a363a5114becbe9ce3533c3509acb637fac6cd736fb21cbf3a86a0546c286d614b99dbfdb7a4353
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB