5541268c88b6c02bfb8bda2d4b07e3e04bb6a03cef1c5e89163b1e9fbc32a430

Resubmissions

09/09/2024, 15:17

240909-spe37axcma 3

Analysis

max time kernel
143s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SummerCamp-Win64-Shipping.exe
Size

50.9MB
MD5

0387a89c97a2349517f1812c165df279
SHA1

7149324d85029ea463f8d2280a2687c824c236d8
SHA256

5541268c88b6c02bfb8bda2d4b07e3e04bb6a03cef1c5e89163b1e9fbc32a430
SHA512

3fd29b1f01ae74081d756a3acd6ccb34f52dc8d6c60e2dc9395a6b2e504760ff35e5bd5dd9df66e54e4a473d55130a088d760d82ef0df51aedeafa4528b583da
SSDEEP

393216:qEBvkdxp1pit13QvvYMxB7aHrnOwZEZhCPeKUP:qz/CLZS

Score

3^/10

discovery

Malware Config

Signatures

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3964	SummerCamp-Win64-Shipping.exe

C:\Users\Admin\AppData\Local\Temp\SummerCamp-Win64-Shipping.exe
"C:\Users\Admin\AppData\Local\Temp\SummerCamp-Win64-Shipping.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:3964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...