Analysis
-
max time kernel
119s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
27-07-2024 01:48
General
-
Target
7cdcf97dd866e2aea2b9f531a3d62a40N.exe
-
Size
83KB
-
MD5
7cdcf97dd866e2aea2b9f531a3d62a40
-
SHA1
129a11227b20475bb1bd7898a94fe858c684f0e7
-
SHA256
45092a814f08c31f94c8e8a4cd8879f52a68b84dff716d5427a2191c6d9c01a7
-
SHA512
adbe9e82f078bb7e7abbc37fcb07e0b9d36aa4bd418c076ac69f4b503f665d761df1516568781f802530fd98d9771ecb3b95fe4e2078f655fd0fabfa4905d343
-
SSDEEP
1536:q4Gh0o4e0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4e05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 9 IoCs
-
UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cdcf97dd866e2aea2b9f531a3d62a40N.exe"C:\Users\Admin\AppData\Local\Temp\7cdcf97dd866e2aea2b9f531a3d62a40N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EC19664-2173-423d-9459-959AF4FB1D64}.exeC:\Windows\{3EC19664-2173-423d-9459-959AF4FB1D64}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA81E6CA-1F0D-4cba-9158-0E105A33EC7A}.exeC:\Windows\{AA81E6CA-1F0D-4cba-9158-0E105A33EC7A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89E9AD56-99E0-4129-8B3F-183A5E93D1EB}.exeC:\Windows\{89E9AD56-99E0-4129-8B3F-183A5E93D1EB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A99F6D0E-35D5-45ee-99A6-0A572BE195A7}.exeC:\Windows\{A99F6D0E-35D5-45ee-99A6-0A572BE195A7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD5E5CE4-E8AD-46ff-BE47-DF7A1049692E}.exeC:\Windows\{BD5E5CE4-E8AD-46ff-BE47-DF7A1049692E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{39FA6343-6A4C-44a1-A621-BE68BE05D766}.exeC:\Windows\{39FA6343-6A4C-44a1-A621-BE68BE05D766}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83242321-1BBD-429d-8CA8-04A0E52B01DE}.exeC:\Windows\{83242321-1BBD-429d-8CA8-04A0E52B01DE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11EAD1AB-58E1-4d37-ABFE-EA36AA8CD4C3}.exeC:\Windows\{11EAD1AB-58E1-4d37-ABFE-EA36AA8CD4C3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{7C6AAFAC-ACA6-49fa-93B4-F8F816627BB2}.exeC:\Windows\{7C6AAFAC-ACA6-49fa-93B4-F8F816627BB2}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11EAD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83242~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39FA6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD5E5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A99F6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89E9A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA81E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EC19~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7CDCF9~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5cf9fcf2476c20f5aad19a5a5263fb27b
SHA10e897434cb174ea27c50877298caf5ecd498f2f4
SHA256ba74a6625e5131a2d4b717df1e181c4bb07f5531c786bfde7775c2109b308f4d
SHA512363e4a8d67a56ad301e9e112d00231f7a9fa8ebe7da74dc6f3baff25b63d4717c0a130a133b16136a7ad2eb6a8c589a030787da6231cf5456abe123f76096c43
-
Filesize
83KB
MD5c4fb180fa23c21f3e9fc7d504e0d5870
SHA1acd0a1a17fea21a23059c0c68e17e227a0d1b1fc
SHA256aeab4cf8bac707838f92cb7a830b5dce04cf9ea659bc17452307a1839df8b434
SHA512136b8869bcf865e3f746f6b1f5e1ca969e8f97da5100f6ce9fddf0a965acff9111e3798e29a1a49b57c2b5a2dc79be98f1fc0b4c3de53a5ba190e7eabda4aa40
-
Filesize
83KB
MD50e65c79de3b7c76f3bbd210413333cfe
SHA1272abbb9e4c78184c4861528ef6bb3bc791157cb
SHA2561eb35abb0e72f7cb01c7f2bb6e2f967168147786be5bbf91d8a771d053eb525c
SHA512192d17ec66191e941ecac6a639bd56def35f98369728b8c3d3458fd1c6011dbba67ac5598622a8a264c404f34a0d43ab2e50f4c0b3329ebd574ed9aea029d5ba
-
Filesize
83KB
MD5df7a24f9e01521e878da7b8270a1767b
SHA140a0fb3710231e79075860021eba7246e7aa228a
SHA256fa594bc64d877ecc1ffc6ed85c3328811205dce6de734f8ffb0e7655a74c6e19
SHA512d3d34199a3076e14c3d111e730cb088abd4f379a90ebb2ea0f179116f299b484c16d3abe025c9116c8a7e7b1a3295b595f9cd2421e2505703586b9d27a75aeac
-
Filesize
83KB
MD59e4105da990987a692227dcf60804269
SHA1ac83ef2fbda81f09c4664631f74658777696f962
SHA2564c68e14f6486c0e62ee1e4f4e7bcb30393765591da82976acfa564287cdd1eea
SHA512cd1930d406aa60dbe4f9618ffa704ff67ecae53dfc679b0e78554e6152ef8fee7abe7e99313b5ab0d04c235be8863b00b2fc63d2121bb0eb8c35175784a49dce
-
Filesize
83KB
MD547e82cb86aca5a986cf388cf01bf3409
SHA18b0c0497ffe87ed69eab37da4474725ab7342598
SHA2562c57a966153f4ac112bf81c57610fc032cf4db363c49df6676823e6b71effbb4
SHA5124bb34e7e5d2dcfae07f283a1d4b5376fd1af55a0b006c4027fe158b306cf6bad13d173cb3b0b95e9d3f9fc801af2882d7986d199c1cb3c86c1d99c4cb5c768ba
-
Filesize
83KB
MD5bb45996488177a034174e3b9ce23dc28
SHA164743ba613499e6793e941c6c8fb6336903abf59
SHA256946b42264fe9ea572ebc162696931d10e353f9120036a3094ef4b7b3b0e80390
SHA512c3755541a50c5497ea95a3a597a0f1437f206e6ede539a6aa977e3c3255606267f943876fb0296e5fd5488cd15b91542b4d69ca3c75941190c3b93b8b5b50e92
-
Filesize
83KB
MD50902c7273613ff6e5e5262d21dcc8a8f
SHA16e506bcad0b1d4993b0aadbeab420bf4847ae4b7
SHA256ac84030901dae8301f79ba2472df317e1eb368709a0f76828cc60418941db570
SHA512f72fb9fe30cc3d3024990e8964971b8a7c1cb9afd7bcc858f774405d260e844752741a6399d97cc1922a1b349420c2d7b1bafe9a9b4d3aa76b20489ce78a7046
-
Filesize
83KB
MD561dd68ee9e7b035d55b8f2be4e491d83
SHA13caa988352b511aecabe619a893e228008c6d727
SHA256654df9095d1c1b134de4d228bb9bf51a156aa8397d19ba791ad175e5aaca5bb2
SHA5121732ce9e1264c7099601ddedde3768be9c6db7c9ff1d5248ce91c6ea092a2c9764185870a20bd6ecb4d609559ad2482a46e418010e660f1b24f35ab7312afff7
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB