Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
04-07-2024 00:12
General
-
Target
8321baeba68ac10e41e11010c95b13f9fb4c1420bf80b9629b65bcd223f52192.exe
-
Size
741KB
-
MD5
ee3bd9dc7ac6feb087730c22374966d6
-
SHA1
5bf8a12317824bd84e7f5b2b37704ba61a2608ac
-
SHA256
8321baeba68ac10e41e11010c95b13f9fb4c1420bf80b9629b65bcd223f52192
-
SHA512
4ff97feeb35e055680df9c9576b06b3dd5c426140a74c05abb57d303de76145df85c3cef3660fdad12efb5a59e3ebfe9a555edcd4a14d89aaeeea72e5600123a
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1FZ:lIt4kt0Kd6F6CNzYhUiEWEYcwh
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8321baeba68ac10e41e11010c95b13f9fb4c1420bf80b9629b65bcd223f52192.exe"C:\Users\Admin\AppData\Local\Temp\8321baeba68ac10e41e11010c95b13f9fb4c1420bf80b9629b65bcd223f52192.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4172,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
742KB
MD5cdf808762d7fed65b3d6d6a14bab3703
SHA1a4055a6cde081a1c79cc81a42bbe9cc1841e8b1b
SHA2561abf6a74a8ff0cfc12a5b0d908b3c419b52e5105f637838b9515c35fe8a15a7d
SHA512f7e0b9b5eefe75faefbea4430d2203e8180c3179cc4f4c701faeccf4ee0065826808203db0f998c1dc26dae70820b0bb9cdfc0e72c97aaa6661047381520a3f0
-
Filesize
741KB
MD57e63ccf31e735d4a865b73c0db5faef2
SHA1508fd78598fe098e4df107b5a3257290ce96037a
SHA2564d66d8f70d0891e7c164a462dfe91650f09cad84bcc1931c68c4468bc964b641
SHA5127003f3ab45ecd71b891e29eee9f939b4ba77da1aeb78a44ba7e0773997065ac1bbd5fe53d2a8d4ceacbfa4f173cc0c6402a464a8fb234ee4b266229acfc95f8c
-
Filesize
741KB
MD509a3bf14e9840574d029d47b8ca2df36
SHA1945b12217ea88506b78a0aec017289bd3a183817
SHA256340d1afa7e2bcbe29d60234fc36f7276db3b1b6deeb91d31f376761a60f394bf
SHA5125c7f06776cb9ccd34a4b719483995fcc978d1fdc8ba5849247b9a4cb441b35115b02cf8c3ab4b245ffcfcc2730989a52cbb6543335a9b263830792112537144c
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB