Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03-09-2024 19:58
General
-
Target
2aea86819a6b684a5fbcad254441232d03ce9c9d7a7841939f9a19097dc70df3.exe
-
Size
204KB
-
MD5
812845a38d0e46c33d6158022a93546e
-
SHA1
b94bd84bf01c5f2ace6f57e68e1ef4f02e122027
-
SHA256
2aea86819a6b684a5fbcad254441232d03ce9c9d7a7841939f9a19097dc70df3
-
SHA512
b039e4d5b6b8bd5e2dccf4ec79ec2ae5f75eb8a8e864c64705c1706f6fd47f9ee0ca4bdc370fec0527621bf1f8bb7d25df134571887abd94f22d3e7d3ae90d7a
-
SSDEEP
1536:1EGh0oBl15IRVhNJ5Qef7BudMeNzVg3Ve+rrS2GunMxVS3Hgdo:1EGh0oBl1OPOe2MUVg3Ve+rXfMUy
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aea86819a6b684a5fbcad254441232d03ce9c9d7a7841939f9a19097dc70df3.exe"C:\Users\Admin\AppData\Local\Temp\2aea86819a6b684a5fbcad254441232d03ce9c9d7a7841939f9a19097dc70df3.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86B2C74F-060F-45f2-B263-801F4BC3F8BA}.exeC:\Windows\{86B2C74F-060F-45f2-B263-801F4BC3F8BA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BDBAC8E4-E316-47fa-9754-49DDAE1D8C69}.exeC:\Windows\{BDBAC8E4-E316-47fa-9754-49DDAE1D8C69}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED73ABDC-0756-4366-86A3-D2585E4C9E97}.exeC:\Windows\{ED73ABDC-0756-4366-86A3-D2585E4C9E97}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B639ED2D-C1CC-4110-BE27-DE95E77B31D4}.exeC:\Windows\{B639ED2D-C1CC-4110-BE27-DE95E77B31D4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC5622CD-615C-4963-AC76-6C449B52AE6B}.exeC:\Windows\{AC5622CD-615C-4963-AC76-6C449B52AE6B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DC2ECA9-41F3-41bb-B8AD-316E655431F2}.exeC:\Windows\{8DC2ECA9-41F3-41bb-B8AD-316E655431F2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85DD056A-5D7B-4d4d-857B-42229FE52508}.exeC:\Windows\{85DD056A-5D7B-4d4d-857B-42229FE52508}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{572D2B08-BF71-4e6a-BB09-9E3674841934}.exeC:\Windows\{572D2B08-BF71-4e6a-BB09-9E3674841934}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5454F782-0ADE-44a2-AEE0-9856FCAF45F1}.exeC:\Windows\{5454F782-0ADE-44a2-AEE0-9856FCAF45F1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78D410A3-6851-402b-B780-162C956E49BC}.exeC:\Windows\{78D410A3-6851-402b-B780-162C956E49BC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A21F9F18-F226-4e78-80A1-B1992B0A6327}.exeC:\Windows\{A21F9F18-F226-4e78-80A1-B1992B0A6327}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1A4F43CC-F0C2-487c-863B-723E169EE9BD}.exeC:\Windows\{1A4F43CC-F0C2-487c-863B-723E169EE9BD}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A21F9~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78D41~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5454F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{572D2~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85DD0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DC2E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AC562~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B639E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED73A~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BDBAC~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86B2C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2AEA86~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
MD5412af69ea37d6a733bb9817aedb48c1b
SHA11cfb9ea3d8dd8785e427bb293aa402726959dd85
SHA256f545e8a27b6bac03c79aaebec5102bb549b67bfa4220a52008f97aff95d07f14
SHA51211c055ebd43d2789804944c394c28ac69b93dec88b3268bf724252fdf9b288cb034eeadca33d01688867f4708a1d9284651802c1d4d7ec61172afe3631ce26f9
-
Filesize
204KB
MD58091bb340133d063e8b47b7c4319f816
SHA1e45292a0751249a92c4bc9c84c0f71e726f3a8ec
SHA256a88a7c1271ab4c6b3fb4c7d60fea8fbcf2e8ff0713ae2521e850663665165521
SHA512137965371d8fa63635c24edf443c87197daf9b3cb4bdda760f22cdffe03bab2b19f8acba1146074e35c84a477e5893e376d14d8ad53a074e7830f66114959375
-
Filesize
204KB
MD5f7faa62ca0d57562944e3ed412888748
SHA1ea1baee40e7a6086ce1e192f76f511c4a5a06bf1
SHA256b6329159c009e6d4600f5f8f8e63c69ef4f42242cb3e280ebc3a180d986fd026
SHA512eaca0fa6305cab9b8c21de6f060b0ee191dd4360732eb743205d77de3bc0fc89f2a982b01106560bb07a269f87e4c19c232798034852be72295a1e66915ffd4e
-
Filesize
204KB
MD5edbec17d63741370e9f373a3e1687449
SHA12e8deffb5b5953fedd119148c0212a8466a3e837
SHA25643194b0a865533c6901474c4a9e1484d42d2d89c781107aef6832b2d37e13ae3
SHA51262bc734b99fcb015ef0df7c1c6c7f41d65b2bb44de9f4d873088499e5ab33ae376efa818c61dcf271b152c237a24242d06a95f4fd995a403e9aea20f65f69bb5
-
Filesize
204KB
MD5261ea6160aaa5ac1b159cdb44d2a4232
SHA133503241546a77dbad0714e2da810568e8ede60d
SHA25685c0759c654a5403c98597872d9602bc13b85218ccada40108c681a4b6590984
SHA512af78a93bc934e3f6657ca70a1284b3341459ca67e19438f39316ec65e4d05642932179235afec3d90043a4c7c8465eb7371b083310a5b016cf03926da0972f07
-
Filesize
204KB
MD5912f40734b8fbe49c47b5856651d223c
SHA156a6d8c843f50b15f9e5d48297b84f19eeaa0a7d
SHA25622e5cb60708f123469cef5eb31f5d1329f5354dd7e9cb414c5e3d8461aab09a3
SHA51233f3cca1be55a2d4a1c3f8cd7945a6e52a5d83a3876be0e59e4a4eb8abdab00055a763580a77420b1ae9114c2779c573fa7d58e1ed9d501d6b476d14fbb1a394
-
Filesize
204KB
MD58f535e04b8be0e9eb22bc5a854fb1f06
SHA1fe1941b552071e2901b3dc9dd6c2f36d92ab2dfc
SHA256e2029ffca88827abf77d1d2b683d98f9e352193e585536e26980b32909b073d2
SHA512f1388bcc774eecb44c2b3720b168e1dea31834d82f3663f55fa460b289d98479820381d6f685e0535d746abbc6062382baac568252b436bf59abc74066a0cc10
-
Filesize
204KB
MD5787582423ec037bd070b020641236bce
SHA1c1ff85bf3f7639f60c1f3d467392d1a5e97656f6
SHA256e903847f427c28bedc8b420f637bc369fbf5f113d666e27d23829737f8bbf2c5
SHA5128e1fdd0b38b6a1313616ca920ecda04c96fbcef8295cf15d0f6ad9a46ac5a8afb399e48400c764952733250d29e5756a499404304700512ac2486ac051c300a6
-
Filesize
204KB
MD555586b176adb66498489f76a7cc8c2bb
SHA1f4391810e32e7af8aaebff75cb0e61ed4d7a384e
SHA2561bf16be17b4afd8986841c9add88deffebeda2c239d9998e48e55e552939c8b7
SHA512116f55f84dbb44858839a6eba44f15b81cc6d77b95fb41d86c4cf9f51c4c0147186f2a336509c0596f0412591254f8b8dbcc420c74032969447696a2208d1efe
-
Filesize
204KB
MD538f1f5db1dd2ac35018e596e7afed23a
SHA19b9a3044630692a3ac4f0e33d077f6c10ac2aca0
SHA256b38a38a1216200b1676623f800ef137ba4d234a37468db8b62e0cb453527fd98
SHA512beb8db95cc481b596e7c4483a28cdea15425ccfc751df3634fd3366ef8561490ae85f1fbbe5f8da10bd28b3526b4ded685d56ea1700df10fdb1c10b5ca3c5859
-
Filesize
204KB
MD51c9350c02f63ca74ab7c774b2100d088
SHA10e586af8884275a8765ef7b1833b7e49c97e6485
SHA256d7c317afb1f16a125cf4ef2e56c4891d06db55657db4c40b75ab0ed75fb2fb91
SHA5125f0cfc15380174a38818632f73fa868a45052de866e1b43f44f1d52cda4eed6d81775c49305021ec8e9263ec4d12073966f2784b2448ffe3a4767d63e22c792b
-
Filesize
204KB
MD5ca7a9f28cfee5169d893309c0c9318f7
SHA11cefc38ca6e97b50051fe552edf569afbefcfd6b
SHA25602e917ccafe598df813f349c4555bf77d38d9af6c52b7ce64d631e1bc79e46bd
SHA5126a9567396b7375695430b2989911eb40193a5446067b7b1d738cba3dbd68e39a390f34bcaf09ae2a9bd0ef7dc6da4dff8e86382f9cc659ce58a7f6aecd58b1d3