Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/08/2024, 16:11
General
-
Target
393646550bfdd0780cf11170e7301390N.exe
-
Size
2.6MB
-
MD5
393646550bfdd0780cf11170e7301390
-
SHA1
95072f969635ba6d27b7be55a4f8b00b265f5928
-
SHA256
6fb7c04ca4faa826c5c11a9eb65d6c6bb57795a7489a2b7603172f12a3842606
-
SHA512
9f7018b331cabc5fb2f86348c88235fec68ae6e13336e8a7613ad51a6fc9872e62a19670765dbf4469768192714aaf8a570abb5ac6918ff4235f852e230e62c0
-
SSDEEP
49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/U:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/U
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 31 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\393646550bfdd0780cf11170e7301390N.exe"C:\Users\Admin\AppData\Local\Temp\393646550bfdd0780cf11170e7301390N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5a08fa653a7822a05fdd244081de22980
SHA14099d84f424ed8fdd92819d21ee41190d8ab12dd
SHA25690b4aa2a8a6ba5bda58639859d4fd155703bc870e468cbec8051df8608a0fa63
SHA512996cdaa42539d027ef8c9398a63e3c678899439696fdef3ae5bf7bd32eecdbd1506b5753e18b0247a41e05f286dec2af4bbcdabc91b12ee36e3252fef6ab31d8
-
Filesize
2.6MB
MD5aba4507a0d4a0189852529120ca98c47
SHA1c46dcdc6a0ca30505fda3c42cb6bbdaa43d0eefe
SHA256d72dc3899c28c4dc42ae3b011c2333eaf009f481c849b2ce9fcf4d308326f7f0
SHA512c3f6dbb93298dffb8e6398a11e0e67b2bfe0e9b79adc9de0d1fe8dd6882a93ec2669471101f4f91122b234222cb512f4f27c714585f4c39808bf86014fe5e57a
-
Filesize
2.6MB
MD5e2cdfe5c088b4096bb8fda2e6cbd1871
SHA1aac2472ab188306b3b53a4ffae8bf1ac7fb1c6ff
SHA2561c39aae11a4205c5be8b4db7de09a6ab2e97ad3b7aaa380bb979567495dcbea7
SHA512e88286623b6e2a96ce84d2eba353ded074fedbdc7b3a92070bc37e576aacb5f104cadd182ffb65e92fce3cdf2a33fb49a791f4945871943ce4ee185b5e01e717
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB