Analysis
-
max time kernel
149s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/08/2024, 22:40
General
-
Target
66be1734daa3da969d53d0f05df760349328ec3f4d167bc86df31a4279b4f5e8.exe
-
Size
90KB
-
MD5
42e2d6db2e515d89ee4c2b8eae045609
-
SHA1
5bec0ca1c773ce276b9bec3206559eb00e096cff
-
SHA256
66be1734daa3da969d53d0f05df760349328ec3f4d167bc86df31a4279b4f5e8
-
SHA512
db55b24951e9cb9352482ed2d849a07ba9f6a9805e4dc74271427117341c049fe682c50f1f010a77e929930672f8a3f56470ec7ed76bdce9984b36b6fd69efe8
-
SSDEEP
768:5vw9816thKQLroL4/wQkNrfrunMxVFA3bA:lEG/0oLlbunMxVS3c
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66be1734daa3da969d53d0f05df760349328ec3f4d167bc86df31a4279b4f5e8.exe"C:\Users\Admin\AppData\Local\Temp\66be1734daa3da969d53d0f05df760349328ec3f4d167bc86df31a4279b4f5e8.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFB57254-D280-40c1-AB06-248771D2354A}.exeC:\Windows\{EFB57254-D280-40c1-AB06-248771D2354A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{02AECF48-14C6-4cb7-A034-B5FB4DAF6099}.exeC:\Windows\{02AECF48-14C6-4cb7-A034-B5FB4DAF6099}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4931F24D-2752-4097-96D9-2CAF50636E77}.exeC:\Windows\{4931F24D-2752-4097-96D9-2CAF50636E77}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FACDE89-C848-4edc-9891-390A2DE44AA2}.exeC:\Windows\{4FACDE89-C848-4edc-9891-390A2DE44AA2}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE18FA03-A307-4a64-8823-106278B27E87}.exeC:\Windows\{BE18FA03-A307-4a64-8823-106278B27E87}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{594E413C-0E39-4b2c-830B-DD07AE8829B9}.exeC:\Windows\{594E413C-0E39-4b2c-830B-DD07AE8829B9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F96CBC4-C2A4-45b1-9E14-1363DF9E1ED0}.exeC:\Windows\{6F96CBC4-C2A4-45b1-9E14-1363DF9E1ED0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F828D3A-4385-4655-A083-E4CB31C6FBF6}.exeC:\Windows\{0F828D3A-4385-4655-A083-E4CB31C6FBF6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8B1F1518-50C6-4381-8F3C-7D10805F95C2}.exeC:\Windows\{8B1F1518-50C6-4381-8F3C-7D10805F95C2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7830C3C-4347-44ad-91AA-781158BD9BF7}.exeC:\Windows\{F7830C3C-4347-44ad-91AA-781158BD9BF7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B084C92-B336-4d35-BDB7-779505564557}.exeC:\Windows\{2B084C92-B336-4d35-BDB7-779505564557}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{F4F3069B-34D2-435e-B95F-227C3D332963}.exeC:\Windows\{F4F3069B-34D2-435e-B95F-227C3D332963}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B084~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7830~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8B1F1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F828~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F96C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{594E4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE18F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FACD~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4931F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02AEC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFB57~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\66BE17~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD555686c933a2503b0c90a1e9490a39a79
SHA169ba1ba41564744b5533ae169c430b6581b4f5fe
SHA2567183cd0f6b4a94c5ff3f0d08a5af191a2184b1e00a8112724e267c6f8c4bd63a
SHA51270687144fe01872527b8bc15a4bc2838eef840fdc8cddf950d6fb2ab53f50be4c9aea83c62132ca9674ca07c4cc8086d3d69fcdcf9b34d43c84b2abb88243a9a
-
Filesize
90KB
MD5f74d19cd0d68ce12c5627698b67d5b1c
SHA183b7d5d21ff701b503a36bdd210c3fd9c1a9d11f
SHA256c262b695d85899178fba9f11441ab88f2aa1edcdf290660ba9d4709904513be7
SHA5125a0367a41bff5dabd26a9610e6158d17a1f45904e87a01b2fe7a58102e7ea508fdf6c5e1300292174fae9aa1bc2336f582e67c63d820ab6af353402ef892cdf0
-
Filesize
90KB
MD501b01e9824e9c3d931345ae4cb1990e1
SHA1b43e04c72af3bcdfa2d037d2f41d9ce6543d0a98
SHA256ac431866ddffc39fe19ac00d9f751d4b8eeee6ab4902c76423fe8e9f00760919
SHA512cff8d6647c32766877e89f720a744639ea7d7b774d8819279e8b6cb04c44f10cce0a93103be5a2b1584743c65d73d908c1989557a801fd29a037d90a3d0908f8
-
Filesize
90KB
MD532add19be0ccef2a9c5cbe0a013703c8
SHA12f8fc478d618452892d54a20465558661a2e64cc
SHA256305950ba971be46c74829c8cee8567d500211cabbf362f30770fc9075829c72e
SHA5128f9a44338533362d781d72928e0e77142989e48733242376b97a7954d00241f440b28cd62d8df11af9d78717578a89ac21cf03e7627f1207426e5100e876c1b0
-
Filesize
90KB
MD5ced8f8fdc1605718ea3d6ba3c4354df1
SHA1d41d1353f500b2d55affd49b06c841afe5598e97
SHA2568ca61a1d43ed3b373c93c9ff86a293cf17c655882b8385e6a26d2f1a3bed8579
SHA5120b23138c2d980c6fcaf32f0331b4f0d9c34222f3ed55ad8c87de63972406a463920094cc8c2053292405781a7602a16245c39260e27c672c60d433801dac48c5
-
Filesize
90KB
MD52aff4d41e6dd28ecebd4388c0f557fb1
SHA1706f67db8ed9266a4ea6d81d5c37ae8c5ca6d803
SHA256eb2e3fa5c35a4016095d753b8c06155249f80eeb772953aa27e5a9edee6a6490
SHA512b3e351250ba74750e1ffac88b9d96a99de6056b51b165821090fcaa9fcd05cae3a1ed9b6e1049b751e20aaa91a299cf2229700b96fb525624f7d4e305565aa1f
-
Filesize
90KB
MD5ab66572dcee256315412568fedddbe07
SHA1627ae4cf086f76b705cc19896340713d6a52080a
SHA256c7438d88b3e99099f3a1f639eb24d9a3c0dba4dca13bc27f89a775a76ef43497
SHA5129f971161a787a560ae46984b6c96d09fc59b1faa82e5680860cefea42c1b08ddc86870afe67cc32ed9241edcee1b92039f71ba5c94b5b2121b8278a994dcab51
-
Filesize
90KB
MD54e4b3b32bf0a43d398edb70886129d67
SHA1f3bb467f2ca09f09ea84513bfbd95443a87614f5
SHA2568e3a63e3ea24575b6831aaa75151a172d394f2a17ddd9f20dfbfa19c3ab73295
SHA512a3864b07a8e6659190bd1cdba2fb088954b7b0485afc8fb85bd7faaf82e6b091ee88170b1a664a038303be3a8d3a67251274ca2f1e937dc663b2501b1b45f1b1
-
Filesize
90KB
MD57debbc48f74074e31e9e8bd41507285b
SHA109ac47ec53606c1a4e0551621c866843ff9c65c9
SHA256655c22ee973ea623afd8d0db2c277569dba3e898bc7b740e48e9daf6788f33a5
SHA5125d2310e0c40c0fff01d07025eaee801802cac5985783784b5d0a9d9625a3633c31550fa4b50f40c5a4bb1b446cf8dbe2bf4d2d57b28f74afd4499037533d5e3a
-
Filesize
90KB
MD5f03c5635d3db2c7f44a0ec5c1f76629f
SHA1a2e7efae53e99f9413ffa9914c193829c80813f0
SHA2566aa71dff52e846feb1f0202d3b3b67609e76de81d32e55dea4a3c90aa5a14033
SHA5120113088b53c18268c840e2f10f9725e7e9ac45da70a739714e1889e00a754b0c64181149d4ad24754a1f79c42e777ee087b3ae528f50efcc9e5adf8c6b355274
-
Filesize
90KB
MD5ff91b654eefbb7f32cd1ccfefb59ccf3
SHA13535d12d0dd3cb239ff9cfa0aadbe0274c5b9a7b
SHA256c310991180bb0b811e531a80a68baef73d95da34abe53f1792cd6cc90b42c967
SHA512b32e169a0023ffc547c419e90d83c1c46e29fb81fe0699850d8376ae069ae2ef1fbd6a51785516f037ff1a46d6026a39bebace70911cf99eaaac488f67c9b769
-
Filesize
90KB
MD5674566ac5bd297cd9ada0cc17378161c
SHA1c25d169984899ecffc056704554e7918659202ca
SHA2560be03cfd2964cf1e7a01e7666ea68ce0eb4980c5b2c9eb63f00b3830dab9a3ef
SHA512eb2eb39b018850cd573eab30c871ab26392825e3962cbedac4aa53dafdc2d1ec568b167d6f0143a806d38552e55b42faf666f2bc3d4b65484953ff2efe350b4e
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB