Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
05/07/2024, 18:25
General
-
Target
07a316323a5023538b558f515fcaf2b4e7d7d1f8fbed4ba753411cc6e1dea92b.exe
-
Size
741KB
-
MD5
73411e742f054c332b8b224a3bb82a2a
-
SHA1
08c19e64d28cdf050a2d43330529ba9c4735397f
-
SHA256
07a316323a5023538b558f515fcaf2b4e7d7d1f8fbed4ba753411cc6e1dea92b
-
SHA512
40d6962b6063944d14d3cfd7ebff06c580ef6043187b353a339f448b5a88360e0c7aa9cb75f2a48f044ef8f127523fb5cb6c3adbce884cb4199f30e90b88580b
-
SSDEEP
12288:ltTuhrf45I8jWtJ8OgL27rd69bk5NCgGhSFB79gYhLIf6EQ9EYcw1F1:lIt4kt0Kd6F6CNzYhUiEWEYcw9
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\07a316323a5023538b558f515fcaf2b4e7d7d1f8fbed4ba753411cc6e1dea92b.exe"C:\Users\Admin\AppData\Local\Temp\07a316323a5023538b558f515fcaf2b4e7d7d1f8fbed4ba753411cc6e1dea92b.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
741KB
MD54170777f00c1a36171fc43fa5742a86d
SHA1191d2367ce868e2d17d33414762ae6791d27b642
SHA25636f6c39d81dad70ca6c26e7f9bc84f6828f22cf59f105d1744c2237cb7a28249
SHA512063d121cb1c026fbd17fc89c246c8c3fd33add6f038a3fc696dc2892839400d2737a1443d16f060c400fb86100db0ea269ed7f7bc7616aca1bbed0826931820e
-
Filesize
741KB
MD595a140dc4ca2aec67da8921251a0d042
SHA1a227831aa8785845ed7a39938a1129c4489aae4f
SHA256138f239f2d9d98c2520c5164fce84875bd616c153a22575765180a794af12dcd
SHA5122135e6ec5280014c9c09e1a1bcde979b566f6e6d74a407efaf254c60205511e576424d14974b06ae417de14edaac2036bad9a86ff34bef7e5cb258f96f88d7a0
-
Filesize
741KB
MD581ce7329b3603b20ab1dada2690df222
SHA147c44f62753984db56eb79a7909066c9209f01f9
SHA256bb4dbc41c647aeb211782904d327f020e7721766347ff11853e4a6143ff88701
SHA512972572583560193ed3707b3210cd8b3d1bd391b5481e978746b4d5507f3a9b9fef70219004723786fde4d3de7797a176930e54aea88378f6db77204c63d97e59
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB