Analysis

  • max time kernel
    118s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 09:04

General

  • Target

    997e8fd5e14ec1ceffe6cfc87a2ec600N.exe

  • Size

    90KB

  • MD5

    997e8fd5e14ec1ceffe6cfc87a2ec600

  • SHA1

    8248d91c60297bebb85809c2992973d4ee6e9a34

  • SHA256

    7c2e71b4f84da16e4addc586bfbe8d24bb03e4a19502f9081c488341f0102dd7

  • SHA512

    e7f68130f3df9557626d2737b55b2cbb78f70b9b71a5ac84250f8cc9e3f6344268631e9860628e3d3fe6652d44428cea84e766577b6a57b277c6121e39055265

  • SSDEEP

    768:Qvw9816vhKQLro/4/wQRNrfrunMxVFA3b7glw6:YEGh0o/l2unMxVS3Hgl

Score
8/10

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 9 IoCs
  • Drops file in Windows directory 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\997e8fd5e14ec1ceffe6cfc87a2ec600N.exe
    "C:\Users\Admin\AppData\Local\Temp\997e8fd5e14ec1ceffe6cfc87a2ec600N.exe"
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4376
    • C:\Windows\{D326471D-61E9-4830-A342-3A47256EF8FE}.exe
      C:\Windows\{D326471D-61E9-4830-A342-3A47256EF8FE}.exe
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\{E90A7F54-1A06-485c-AA10-438024F27674}.exe
        C:\Windows\{E90A7F54-1A06-485c-AA10-438024F27674}.exe
        3⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3772
        • C:\Windows\{76CB9F25-D18C-45cb-8F74-6CF211AE1C86}.exe
          C:\Windows\{76CB9F25-D18C-45cb-8F74-6CF211AE1C86}.exe
          4⤵
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5036
          • C:\Windows\{6C276BF6-E8A0-40de-BD68-2B32AD464A14}.exe
            C:\Windows\{6C276BF6-E8A0-40de-BD68-2B32AD464A14}.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2196
            • C:\Windows\{C41978B6-D087-4be2-A91D-10A4D0E22554}.exe
              C:\Windows\{C41978B6-D087-4be2-A91D-10A4D0E22554}.exe
              6⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1448
              • C:\Windows\{CD588B29-971F-488f-9AD6-88E203D5811C}.exe
                C:\Windows\{CD588B29-971F-488f-9AD6-88E203D5811C}.exe
                7⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3312
                • C:\Windows\{C9E15E86-6FFD-4d64-B64E-CA3255F10E91}.exe
                  C:\Windows\{C9E15E86-6FFD-4d64-B64E-CA3255F10E91}.exe
                  8⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3760
                  • C:\Windows\{68C52D27-8E19-4271-883B-A0539C623F82}.exe
                    C:\Windows\{68C52D27-8E19-4271-883B-A0539C623F82}.exe
                    9⤵
                    • Boot or Logon Autostart Execution: Active Setup
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:3276
                    • C:\Windows\{5444CE4C-77BD-4c3d-8E5E-82094C057331}.exe
                      C:\Windows\{5444CE4C-77BD-4c3d-8E5E-82094C057331}.exe
                      10⤵
                      • Executes dropped EXE
                      PID:2688
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{68C52~1.EXE > nul
                      10⤵
                        PID:4496
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{C9E15~1.EXE > nul
                      9⤵
                        PID:3288
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{CD588~1.EXE > nul
                      8⤵
                        PID:4036
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{C4197~1.EXE > nul
                      7⤵
                        PID:1436
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{6C276~1.EXE > nul
                      6⤵
                        PID:2908
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{76CB9~1.EXE > nul
                      5⤵
                        PID:856
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{E90A7~1.EXE > nul
                      4⤵
                        PID:4836
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Windows\{D3264~1.EXE > nul
                      3⤵
                        PID:1248
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\997E8F~1.EXE > nul
                      2⤵
                        PID:3680

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Windows\{5444CE4C-77BD-4c3d-8E5E-82094C057331}.exe

                      Filesize

                      90KB

                      MD5

                      68456e09d94562960ed28925e1cb1ebd

                      SHA1

                      775016be58870a9703dc59b5d6aeaa019cb58dc4

                      SHA256

                      ccb8cf0f7c97e624e610392751f0928afdaa5464c8fe2c1e07d9ef04e69d349e

                      SHA512

                      f4e22de3eaa896027a2ac6cfa771032a34c46f024b61063da56ccd38503ea3baeb4ce9723c03eee44e8ee0f33cfd8bad080f409ab71d546d699c92f36bbff659

                    • C:\Windows\{68C52D27-8E19-4271-883B-A0539C623F82}.exe

                      Filesize

                      90KB

                      MD5

                      b381fe8a2c043269358e2919822358a0

                      SHA1

                      187989d5261d1536df4d30833363469a7001b9b0

                      SHA256

                      e0ba5d090b1f4d3bc95131bccde9bc118d6339c192e3cd1778d6e8b0b0942a34

                      SHA512

                      e268c6174b8dc5a872668b7889f78a908a3f1550ee318f13e04e208bbc2d5ddba370c92d452b1bbc05033031e8701ff7ee675abd650fa313c922cab493f5f03a

                    • C:\Windows\{6C276BF6-E8A0-40de-BD68-2B32AD464A14}.exe

                      Filesize

                      90KB

                      MD5

                      b0ba6f02c5d1a037716e41065541c84e

                      SHA1

                      65e4203a92598ff9bb5573915ada6f8054f04107

                      SHA256

                      658fe4edbcb268149813a29897f55b864f67c13c45393f16e0dac93aa079cd20

                      SHA512

                      2e43e6f78ae8d1804c475f7dfcfb309e7f39e015f44e40cc22f6d40c7d31cf4e9cc5aa713a70376e848eafd4185912541914b0a6755e6dcfdce5b6f3e51507b3

                    • C:\Windows\{76CB9F25-D18C-45cb-8F74-6CF211AE1C86}.exe

                      Filesize

                      90KB

                      MD5

                      b4b4325c61f0e783ce88f89b65221466

                      SHA1

                      aa3d8edf9c1aa9457fe39c0246f852be4401756f

                      SHA256

                      551bdffe42a657d570d81d5e5420027493c8c6533fee3581671e270f6ec79fce

                      SHA512

                      45935aa234d52cef6dae22a79ddd3c1ba6429ddce8bad2051446db1ccf21faf1dca9242b0aedd5c623245a88898fb9ec1567b133f7d5bd35985cc9de34c337d3

                    • C:\Windows\{C41978B6-D087-4be2-A91D-10A4D0E22554}.exe

                      Filesize

                      90KB

                      MD5

                      21b19dc5e84e948cfffbd7107ee5d54f

                      SHA1

                      3cd068d29fa0ec92e76baf8cf5c7e42f0b728038

                      SHA256

                      012e9d8930e40b2267bab9bb6369b6317bc7bbe207f1300f7346d9a86a601b9d

                      SHA512

                      6f1da5362df59696df85bd028936ae35076c768236c03ca9a3019d31b4cb82e2cfde57f1a461177c44332989477af247c26369be2a752736d0e0279782758334

                    • C:\Windows\{C9E15E86-6FFD-4d64-B64E-CA3255F10E91}.exe

                      Filesize

                      90KB

                      MD5

                      170afb59e980c12bf66ded2d369505e5

                      SHA1

                      80b33938b5d9fadd0ab11166fe0be6849aeeff72

                      SHA256

                      29510a9611cf6fa1577279396b4147764d214420b63d211381a74f07f98d5c4e

                      SHA512

                      eb0212326c4b3f468871118f371355440d8b66fc413550f919426c63a90d93cc57d1dbb8b7d29ff381f61c5c2517a3ee7db9e96d2a16a3968556165ec427bcb1

                    • C:\Windows\{CD588B29-971F-488f-9AD6-88E203D5811C}.exe

                      Filesize

                      90KB

                      MD5

                      1bbf212c094b8fba83901fc60f2c4c9f

                      SHA1

                      08c2699341c58aef568d9c361295da70e4d5e8b5

                      SHA256

                      b272f69461597ed6c08f4ab15c7ea4049fe0a74345ca7139b6a34745d72c7865

                      SHA512

                      09ba565646e520b54b28a8e01bc64810902c09a43b7dad5ebda04dec07d32927930d0cd953ee89ea7d4354af84f5404bd99a3f0175de3a736dfc70583e78c38d

                    • C:\Windows\{D326471D-61E9-4830-A342-3A47256EF8FE}.exe

                      Filesize

                      90KB

                      MD5

                      de168081b6ccb5ec19d977ebdc83aeb5

                      SHA1

                      d68870505587d7d34992d9f4687b5c0f602911b4

                      SHA256

                      96da067e995500bb948b63a36e4095af974b9c51b69a4b4de6d35bd22c6cde3f

                      SHA512

                      23c3a38d0ea66ffdb65210c98f5e5278bb755a8143236c234f06ca1f47731a3ebea2ab692cf4867293e1a899f66863799b3d8ab75e9572d876ececc5f6a011f6

                    • C:\Windows\{E90A7F54-1A06-485c-AA10-438024F27674}.exe

                      Filesize

                      90KB

                      MD5

                      ebe7ccc10f2d8e12b45e9df4b132ecde

                      SHA1

                      d9ee87224bedab5bd7d361b0c8427094582551e6

                      SHA256

                      171295df5a4ed6c0cfd3de92ff276d66ad7751f180feb7b0b5359207bace6993

                      SHA512

                      c0d7927555fe86860908ac9b5dc7e90a8fd64fe13a469bb1f4e4d6304d9a5b665cd0b0d9e738e1e513875b3a243296902eaa8043cfd7f812fe1d5194b10ffb34