Analysis
-
max time kernel
55s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
05-08-2024 15:19
General
-
Target
a5e1bc4246e56b69f92d12d97a724b10N.exe
-
Size
504KB
-
MD5
a5e1bc4246e56b69f92d12d97a724b10
-
SHA1
859c122728d9e3ff44a200859046d53ccb525d3b
-
SHA256
2fa52ffb889f69c25c68df16f3c873d61374dbb41b7fb3c48bad6b48356f28d4
-
SHA512
1ecb43294497678594b83ed44693531990f92213847bb9af904c0233aa0f2c61bf9733825011eacac791bd7b86dfa0fa9dd1a3498852f4de17ba4d79c34bac60
-
SSDEEP
12288:pnt5Wgjtc5yxkQ1sTv5/j85SaNFu1ZXo8LcT8NmzmF1GoxbCoDWrrcV:73jS5KsTvBdajGXo+NmzmF1pxb1D3
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5e1bc4246e56b69f92d12d97a724b10N.exe"C:\Users\Admin\AppData\Local\Temp\a5e1bc4246e56b69f92d12d97a724b10N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a5e1bc4246e56b69f92d12d97a724b10N.exeC:\Users\Admin\AppData\Local\Temp\a5e1bc4246e56b69f92d12d97a724b10N.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4741⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504KB
MD59589a24c6fa0b11f257234a9c845573d
SHA12bb6f9c6761191d04a4b4c91f1c4f6fe31c2f07c
SHA2563b4c2cc48bc525cfbda14b3670d4b796806a0a75eb16a74e2f17f208e9c4054b
SHA512ea0d26c38cc6c42e09eba46975a3525d9472f7daf5710aa0e350198206c0b27357288913ff356f6ded68ba36587800335a0a17f562abfbeea6b87b4e4b7e2de6
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
360KB
-
Filesize
456KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
360KB