Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
20-07-2024 03:49
General
-
Target
9eed0266959ef508668bfba87de09ef6aa5d74dd19e91f0e74b6e3653d448b1a.exe
-
Size
1.4MB
-
MD5
f483d3919a4f8b932b329195106ecfee
-
SHA1
1f2b52b938c5437772bbc0935d5425b69ba280ba
-
SHA256
9eed0266959ef508668bfba87de09ef6aa5d74dd19e91f0e74b6e3653d448b1a
-
SHA512
750fdc354f84369caccfc625a4ab4262482c30efc4930f1e37416dd1980daac15d872dcb4d57a42257f31572a616b60cba8d7327d7bb43c00a19dc2bf589b6fe
-
SSDEEP
24576:BNRdUdTL5Pe7YDHwviQ0whanJTy314OUcuwwzoG4+IPg/3tFVm2:vcdv5WUH0aJTylWcs5IP63tFZ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9eed0266959ef508668bfba87de09ef6aa5d74dd19e91f0e74b6e3653d448b1a.exe"C:\Users\Admin\AppData\Local\Temp\9eed0266959ef508668bfba87de09ef6aa5d74dd19e91f0e74b6e3653d448b1a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nswD718.tmp\SaferWeb-installer.exe"C:\Users\Admin\AppData\Local\Temp\nswD718.tmp\SaferWeb-installer.exe" "C:\Users\Admin\AppData\Local\Temp\9eed0266959ef508668bfba87de09ef6aa5d74dd19e91f0e74b6e3653d448b1a.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
Filesize
478KB
MD5cd788cd014faf68e4880fcacc87d584e
SHA188939cf32a2c4550046304c36a830e89f8d53ae2
SHA256c27bc42aaccb99060646cdac71f4afc363eba40197f53222e7c27613c289cf92
SHA51257de1f077f5a3b6c12308c35c63c44b701a9239b2d22dc3a8a1f5b2392feb3082757523c5f0ae1942b3a3ff5064e3707524eaef15b68772f7c6003c613906a01
-
Filesize
156KB
MD59deba7281d8eceefd760874434bd4e91
SHA1553e6c86efdda04beacee98bcee48a0b0dba6e75
SHA25602a42d2403f0a61c3a52138c407b41883fa27d9128ecc885cf1d35e4edd6d6b9
SHA5127a82fbac4ade3a9a29cb877cc716bc8f51b821b533f31f5e0979f0e9aca365b0353e93cc5352a21fbd29df8fc0f9a2025351453032942d580b532ab16acaa306
-
Filesize
218KB
MD5f8978087767d0006680c2ec43bda6f34
SHA1755f1357795cb833f0f271c7c87109e719aa4f32
SHA256221bb12d3f9b2aa40ee21d2d141a8d12e893a8eabc97a04d159aa46aecfa5d3e
SHA51254f48c6f94659c88d947a366691fbaef3258ed9d63858e64ae007c6f8782f90ede5c9ab423328062c746bc4ba1e8d30887c97015a5e3e52a432a9caa02bb6955
-
Filesize
177KB
MD583ad54079827e94479963ba4465a85d7
SHA1d33efd0f5e59d1ef30c59d74772b4c43162dc6b7
SHA256ec0a8c14a12fdf8d637408f55e6346da1c64efdd00cc8921f423b1a2c63d3312
SHA512c294fb8ac2a90c6125f8674ca06593b73b884523737692af3ccaa920851fc283a43c9e2dc928884f97b08fc8974919ec603d1afb5c178acd0c2ebd6746a737e1
-
Filesize
248KB
MD5a16602aad0a611d228af718448ed7cbd
SHA1ddd9b80306860ae0b126d3e834828091c3720ac5
SHA256a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a
SHA512305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511
-
Filesize
10.8MB
-
Filesize
32KB
-
Filesize
256KB
-
Filesize
10.8MB
-
Filesize
232KB
-
Filesize
10.8MB
-
Filesize
488KB
-
Filesize
8KB
-
Filesize
168KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
192KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB