Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26/08/2024, 06:31
General
-
Target
0634e3a32482f4f87a3255a68340df30N.exe
-
Size
523KB
-
MD5
0634e3a32482f4f87a3255a68340df30
-
SHA1
a8e9b13760ae2bed99ea7361b937ba42fe829d56
-
SHA256
30014d270738947c823941ac9f8241dcf90c19c8b949cff088594fef51186dda
-
SHA512
5b15f24d8d8fee3d385c5b2845fd4ce152f116928794a1bfc941c4a51859654fcc67572d2306514cbf03b439e67858268d90066249588c07ff792d152d4e89e8
-
SSDEEP
12288:nLPkCDt1EG2XVekhdeTmWd72OzE0j6IXlr3ddFYSjDP:nLPkQ1bqA+W0OzLXldYSjDP
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 39 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\0634e3a32482f4f87a3255a68340df30N.exe"C:\Users\Admin\AppData\Local\Temp\0634e3a32482f4f87a3255a68340df30N.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\esenunch\ddodPING.exe"C:\Users\Admin\AppData\Roaming\esenunch"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~8F6F.tmp3516 536072 860 14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 6043⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmdkedit.exeC:\Windows\SysWOW64\cmdkedit.exe -s1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4036 -ip 40361⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD5aac3165ece2959f39ff98334618d10d9
SHA1020a191bfdc70c1fbd3bf74cd7479258bd197f51
SHA25696fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974
SHA5129eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf
-
Filesize
523KB
MD5996744b744f99b64fd65e9948db898c7
SHA1163de5b51daf2a1ec08be42443aa3c93067c6423
SHA256ce4587f47dc09ba65d1dfe4813a0bc04520d7e5aea8b4a2e9f9868deb5f9645b
SHA512f844883417ada01a54f593afb08a4c1cefb3d9e4afac3b86247a699f63a77b9290edc643cb2ae76698268e4e56d6b4126cc4c12b0ccf8bf1ed2cd525df5ce6c6
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
24KB
-
Filesize
52KB
-
Filesize
24KB
-
Filesize
584KB
-
Filesize
584KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
24KB