Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
03/09/2024, 09:07
General
-
Target
6bca22c08cf23a40dc7e4895dec1e269768c37a84fe672ebca71f9bcd7ab5632.exe
-
Size
14.3MB
-
MD5
fc844b5128c40257342ae9930a4240b0
-
SHA1
9d173667ea5c0ddba877112661fa6119ab9e1858
-
SHA256
6bca22c08cf23a40dc7e4895dec1e269768c37a84fe672ebca71f9bcd7ab5632
-
SHA512
5d651cd6a13c5378175673402e1df487649097a5077a0e24368f800991db23b998b3ab3b92af28634c1d476932113cc99cd49b3e3dc77fe5a35489b5e7734023
-
SSDEEP
393216:/abopteQbBlROLNM112Q9R/9mmGKJxV6edA2YM:iiFmLO1IQ9nJ6o
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bca22c08cf23a40dc7e4895dec1e269768c37a84fe672ebca71f9bcd7ab5632.exe"C:\Users\Admin\AppData\Local\Temp\6bca22c08cf23a40dc7e4895dec1e269768c37a84fe672ebca71f9bcd7ab5632.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5eb84f38785a4171970701f130d5aa799
SHA140031abda5c9951ccda255a254a905b7f20e8ab1
SHA256f7b8ddce49f8b7d19ae34ee122fe9c4cd13eb4c65e0c521bd6a6e6722da789fe
SHA512ddbceee986fb6f20d0a12d7695cef09e4b25d7dbb5dbc5c093050171d024d541ec3fc7c8e4d5601b156ee97081f8867c15a75308520152702ae62de651afb3bb
-
Filesize
549B
MD5f56bbaab0a356a71c200911bdc2db750
SHA1bb33a9603de7fc9cfb194438c391c3a825f73edb
SHA256d31d083f9a92578376623357238678db6f2259ff574673a793eb223e5a361726
SHA51244e6441e19ade9a8082e93ed7af6720b89c02f2c2f25c4105168577f0b1429aa504cb17185df3e8e545331b8835327479c5d726cf0089cf11942f373cff73446
-
Filesize
1KB
MD51afd35b305c72f0ab1f648b8ad62d71a
SHA1955d5bd20ce36f95d65a3003499c697d572f5f15
SHA256fd29b69948003e726d9268f44a6c14ff51042815d57a21dfaccca0704a0631fc
SHA5129612e93203c5e2b4c7f752fffc61c808289d99f0bde714f20a3750ed0bb84e563ec401b4b1c8ca948358d732bfde9ae007941f8a613ea2f9182adcdcea77cd53
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
4.7MB
-
Filesize
14.2MB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
4.7MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
4KB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB
-
Filesize
14.2MB