Analysis
-
max time kernel
118s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-08-2024 08:24
General
-
Target
3cf8a1a3520dbcc70de50b0d990e9e60N.exe
-
Size
83KB
-
MD5
3cf8a1a3520dbcc70de50b0d990e9e60
-
SHA1
687b5dce5900de470c3a4610ae924db2faccbde0
-
SHA256
28f975742af2f6fb6e2a27f397c758c37867583d1c85df1be90c087c9527db7d
-
SHA512
dbba31211ee177fd93ea0826a4b45f9c913ff3c80494b79378a4ba04510d34b0b2388cc493c28e72afc32df656afeafbaf4e82488811b18ac35a81efd547b50c
-
SSDEEP
1536:q4Gh0o4jl0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4505outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 9 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cf8a1a3520dbcc70de50b0d990e9e60N.exe"C:\Users\Admin\AppData\Local\Temp\3cf8a1a3520dbcc70de50b0d990e9e60N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C296F542-374D-4173-9E58-3E33A1C59446}.exeC:\Windows\{C296F542-374D-4173-9E58-3E33A1C59446}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4707AF13-A949-442d-B7E0-AB542AAE5827}.exeC:\Windows\{4707AF13-A949-442d-B7E0-AB542AAE5827}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A250AED5-3DCB-470e-966C-D8B32F09892B}.exeC:\Windows\{A250AED5-3DCB-470e-966C-D8B32F09892B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FC03E5D-C14F-4093-93CF-01BCB5FCC0E6}.exeC:\Windows\{5FC03E5D-C14F-4093-93CF-01BCB5FCC0E6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94921937-1854-4902-8DFB-14E35A64DEE8}.exeC:\Windows\{94921937-1854-4902-8DFB-14E35A64DEE8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B338EC21-1B51-41a9-8F6F-364B57F44795}.exeC:\Windows\{B338EC21-1B51-41a9-8F6F-364B57F44795}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BE785D3-9355-4bc9-9244-E8AB6893C08B}.exeC:\Windows\{1BE785D3-9355-4bc9-9244-E8AB6893C08B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECF1D9DB-4449-4468-B008-DBB0A6B78F67}.exeC:\Windows\{ECF1D9DB-4449-4468-B008-DBB0A6B78F67}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED01ACBD-B213-4154-9573-BC9644B2323C}.exeC:\Windows\{ED01ACBD-B213-4154-9573-BC9644B2323C}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECF1D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1BE78~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B338E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94921~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FC03~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A250A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4707A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C296F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3CF8A1~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5e13926abeb7c14e61174c1ad57bdb562
SHA12bd5304487b5c76e4f072c44f6d8b187102a08a4
SHA2564d39837a2dde3b92eea4a46130727c7cc9a5cb5899233eade8bd112a5b34e49f
SHA512e5f2732c06797cfe9092fb75c12309fe8e90b5c58a92895ffc45d5ee0e5ba64fb3651e3b9d0526e92445507fbd849e1dd88e69361005951b856f56691694108f
-
Filesize
83KB
MD59f79fa4bc1bc64d91b4ac6a287aac5f7
SHA189de2a4b0c9f92f5d20d95bbbbe0ac6747214e56
SHA25657ad506ffcad257556bada6bb2c24fd9bf103c9efe966db6baae45dc3e4ad883
SHA5122da8a83a63fd1e4fe45c8ce0a07723c9b07f920e07a20fd9cd15ee342adeddd663508060a38b4b6e7ec9b96cd309a4eef349d7057721125a74667cd9530161b4
-
Filesize
83KB
MD56f2cd486895faa1821cbc78a4db31e96
SHA147544be1d139c0b41ebab10e8b1130c79058dcf6
SHA2560b57ce03dfb25f4f7802abc1c73a2dc79b240e6bc8473fbf636f533bbee7cd3d
SHA5125ad63ff1c728948480fa2937de9deffb562607ba8be086fa759f293acd6fd8137939833a5dfe305bc2723a261d0760c38aad915d29a7fc0ab367378151ea756b
-
Filesize
83KB
MD55c70e5abea5dd0d82cae4f213363346a
SHA1753e1053033d1c8865ff732c2049d8d512835f90
SHA256990b1a3759a293df9eda9facfa00b163a2c3b6900b766c6dfbffe8d438d4032e
SHA512f0d4eed58077734a059a1774c971398f355d6f5c4168db87ec636867208bb04731c7ed82f24a82fd1c1a55a8d7e0140665e73b637f672d620eb752a98c02e922
-
Filesize
83KB
MD59132752806c3bfcb5ea6364a24548a31
SHA17ef98ddf7ebf7067604d3854991d35ecc4eaa08c
SHA256b5cc4846a1214474c67677cb6d5343d0ba418ed689cdf33d024a57c381062f1a
SHA512b44b21ed9a98643f62fd46b13274718eb9bb3fd42bc99f06f26dfe9cbc8798b1f3e528f823516348a8b5b6be2aa506f46b4a8c2b7d80c33bab77fe6857c3a337
-
Filesize
83KB
MD54008d1d5f2c484c95af90f20ff220b6a
SHA12fc76a9afd34d04b6588b8f411ac935df320b2f1
SHA2568a60e676d41214d39305fe11baf5feaaa98d3b450773f772015cd2345bbbd6ca
SHA512b0edd86e49c2562e70ab444b2b6c8b75f9473b268610ef19e68b4757ab18b4ac19a7d515a60ac518a2391f3f0f56cf3c3675556ec0eee474c48564fc594938bc
-
Filesize
83KB
MD5ef10a5dc701b8cd394661f9049998113
SHA17aaa549842bd74663eca93f6303262342422d5ff
SHA256ae6e69ec81741d796d14a2b37dc9c5cd284ca65d7b983821571d4a03799e5dc3
SHA512970ca48d1160803d0d7b011bac02cd2f49ecf6496efaff07ad745cd9598b14278b7c24bd94afefd21b543132ee098428e77f62918726c5239506cec28a5333c5
-
Filesize
83KB
MD5baacb028fbcbbb37aefe38bc8c921f5e
SHA1b4a3c1c8a4193e777e68ccbdb64f273d43f87ae4
SHA25607867f6e87b3b9d21991b0b1b9cb20a1eb71d07db7baf1cf45642a45b5a2adce
SHA51240f02b27eab33c2341fdf4ebe35706cd16fe118f995ab82b743df02ae25d0a3090d5d27057af005f9c50d8f8634f8204e3c110c1a649f3769f3560c785827702
-
Filesize
83KB
MD5a3325742ab194077d81a03e13eea53a0
SHA1640011820bb2af75299bad11c954ffdf4d20a87a
SHA256c797b981bf103135c9b12345fe81d189801892a7a5f91df987443487826ce922
SHA5127039220b2f075445c2e18e7782b2dc2e6b4e8a9d7063dcddc6f2c7037db784bfa8923a859cadde208596692db6094bd1439aca1c2c1525aa22a97921d1c8220f
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB