Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07/08/2024, 23:32
General
-
Target
761f87dffc92a6bc5a7f0942b7ebc63e119a70e6f687e7a61518afc06e80e26e.exe
-
Size
41KB
-
MD5
fe3a6d361354d718e180181846f50545
-
SHA1
32b2049b767adb407f8a982ced699700a67c6152
-
SHA256
761f87dffc92a6bc5a7f0942b7ebc63e119a70e6f687e7a61518afc06e80e26e
-
SHA512
18cc526473f2a04573cc21248d28bdd828157c3d439d29f1febc42cbee56d9fbdc19733079891fa97c2fdac9a62b5612093b20b43f12d52bf3739ddcc23a3705
-
SSDEEP
768:AEwHupU99d2JE0jNJJ83+8zzqgTdVY9/:AEwVs+0jNDY1qi/q
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Executes dropped EXE 1 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\761f87dffc92a6bc5a7f0942b7ebc63e119a70e6f687e7a61518afc06e80e26e.exe"C:\Users\Admin\AppData\Local\Temp\761f87dffc92a6bc5a7f0942b7ebc63e119a70e6f687e7a61518afc06e80e26e.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
Filesize
41KB
MD54524a06de854b04e85002d74df3f1ee9
SHA1670456348bb1933b4dc78747c19fe624adeddb96
SHA25651c0aba81a3e513e8d4ea604f48935be08d3c374b1eb99ea8bc0b1e2ad9289a5
SHA512e503eab19088300275f8c35d1f5925315848464a6bd81d8ad02a015979c1e0bf1095d47f0bbfad600fb48595c977df8ba3a59decc51d83850ae4e54dd9a3bc18
-
Filesize
192B
MD53cd2c4933cfb880618ff57cf1a6b182d
SHA1cd53efdb4589e7c7b6bafb24ea4aa6bee0ff2359
SHA256fb8b8b5eed4c1327afaa5186608fd3e46cc378dd1757a5682ac221aef197ca26
SHA512ee2d18ca37d9482caa0adfef48226b3bbbc8ad85c31a12c88fafbd3fc4c91621efc5be4df51fedc8b1a7a199c80b71e530d16b68de2e8f161425435b7b36c4b3
-
Filesize
192B
MD5d1b09278964304ac35fe3783e7a03ba1
SHA1ecafd2ea91a266c4e884de1a49185e3528b1188e
SHA256e7c9c242cda0b214cecfd65b1e615044f46ffbc79ec8a5fd03476a8bb02552d2
SHA5126bf0309c4624e0da94cc6103dda10c8a5a1027a33a42f7ac76784a6d7a322d8644d36f53444d61e1f132e226ea70c14a684e3e6b2fcc5b6d95c39365736d1413
-
Filesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB