Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
-
submitted
07/07/2024, 03:49
General
-
Target
3bfa334b452f658ffa46b8ed3cf7b1d0N.exe
-
Size
469KB
-
MD5
3bfa334b452f658ffa46b8ed3cf7b1d0
-
SHA1
ebaf6fa7ab76b2ef04809f05d861c13edfbd81fa
-
SHA256
174c091cc77bbb7cd052640988e4ca708bb626211350e58c25ac76db89fcdb58
-
SHA512
ba3ff4dc955c42083260231db960f4d320c72f10f76c49e29357fc123fee368b2b5970455bfc120d4decefec2c195b80e3e0e3334621cadaf1f7115fd5712a5e
-
SSDEEP
12288:Velc87eqqV5e+wBV6O+yBEu7lC6aNnOYv:VeSqqHeVBxVEL1AYv
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\3bfa334b452f658ffa46b8ed3cf7b1d0N.exe"C:\Users\Admin\AppData\Local\Temp\3bfa334b452f658ffa46b8ed3cf7b1d0N.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\convinit\Fondconv.exe"C:\Users\Admin\AppData\Roaming\convinit"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~7A12.tmp3548 480264 2116 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\SysWOW64\certicpl.exeC:\Windows\SysWOW64\certicpl.exe -s1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD586dc243576cf5c7445451af37631eea9
SHA199a81c47c4c02f32c0ab456bfa23c306c7a09bf9
SHA25625d2a671e1b5b5b95697ac0234ce4d46e0d0894919521b54aabebd9daecf994a
SHA512c7310524f9b65f811146c1eb6ae944966351ac88a95fbc1ac422d8810730e5e212a7e28090ad758ea23c96ba38073e7fcf42460575e7f09dbc759a45c5d5a4a4
-
Filesize
469KB
MD50c2f15122bf6d5ed8e30bc07ae581bc7
SHA1d958c248a57d2e2958392ad50a2d68c18a258d8f
SHA2569650097d523e1adcd6ed2d6c0e68872fe4f0cc3ac69dadecd0d9d5022545636d
SHA512895651fa38ecb5f4fc7e877bfbf865e165c6900944fd1a45472e51a73a11d6e212cfbe81d82fa9d1f1209593f11eed7a85641ac59094fba482ec2b8bc74974bf
-
Filesize
504KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
504KB
-
Filesize
512KB
-
Filesize
20KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
532KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
532KB