Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09-09-2024 20:40
General
-
Target
3b8c3fbe73466b0efded1677be24f5aa3c9dae4f27663597f2d86927276b575b.exe
-
Size
83KB
-
MD5
96c7ee873c0d3d98ce5e8710f81d01c5
-
SHA1
3c0f3ac31c87ef0a40cef7e413e1e4b7ee9219a1
-
SHA256
3b8c3fbe73466b0efded1677be24f5aa3c9dae4f27663597f2d86927276b575b
-
SHA512
16e32d923f86ba3b497c95c322b889ac4bf697a9eb6c8a627d38449fd5fa73a425555d841f32ffad1ddc77f2665dd42c9a3dba17a7a9cd60175647757dd324f9
-
SSDEEP
1536:q4Gh0o4g0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4g05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
UPX packed file 48 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8c3fbe73466b0efded1677be24f5aa3c9dae4f27663597f2d86927276b575b.exe"C:\Users\Admin\AppData\Local\Temp\3b8c3fbe73466b0efded1677be24f5aa3c9dae4f27663597f2d86927276b575b.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79A0F90A-E92E-4f81-9FFD-545CF36BFCF2}.exeC:\Windows\{79A0F90A-E92E-4f81-9FFD-545CF36BFCF2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4DDE6D8C-C7BE-40a5-8CCE-7E10CC62B213}.exeC:\Windows\{4DDE6D8C-C7BE-40a5-8CCE-7E10CC62B213}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{489B3ED0-BD27-478b-A742-1D35562CAC41}.exeC:\Windows\{489B3ED0-BD27-478b-A742-1D35562CAC41}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{43F0395D-87A1-48c9-8DC3-01F77ADC8785}.exeC:\Windows\{43F0395D-87A1-48c9-8DC3-01F77ADC8785}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F77C045-1525-49eb-8379-8D458643BB01}.exeC:\Windows\{4F77C045-1525-49eb-8379-8D458643BB01}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0854FA8D-CB7A-47d9-B2A4-D17E6B5034DF}.exeC:\Windows\{0854FA8D-CB7A-47d9-B2A4-D17E6B5034DF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A1B4F35-035C-4f24-96BA-FFD744319E79}.exeC:\Windows\{0A1B4F35-035C-4f24-96BA-FFD744319E79}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{040CCF8D-AA5A-4d15-826E-9BAC4844DD49}.exeC:\Windows\{040CCF8D-AA5A-4d15-826E-9BAC4844DD49}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{43E56BE1-58D5-445f-AE4A-7C5C7314EA2C}.exeC:\Windows\{43E56BE1-58D5-445f-AE4A-7C5C7314EA2C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB12920B-C414-4995-9B69-8B02DA3C8D0D}.exeC:\Windows\{EB12920B-C414-4995-9B69-8B02DA3C8D0D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{87604F2D-AA80-4e4b-B150-C1B04D2D3F76}.exeC:\Windows\{87604F2D-AA80-4e4b-B150-C1B04D2D3F76}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{22589708-55A8-4835-83E2-780F024B407D}.exeC:\Windows\{22589708-55A8-4835-83E2-780F024B407D}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{87604~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB129~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43E56~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{040CC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A1B4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0854F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F77C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43F03~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{489B3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4DDE6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79A0F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\3B8C3F~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5ef0a9eae414a8439350f9a64ed4974d0
SHA12c2490748b14d22e912f74d242f55188288332a2
SHA256796c9890847f244538a1aadbc80f0d9f5f1f77782cb9ecd2254e48ab7609a7fd
SHA512efe1633db91ecb6532fc8c82fa9acafc6e2919518ff23acf441c66d3c7d98dd7fc0d9e7a9afb732bd70a14e1473941328b93047f27b993dc71cc5491fdd3fe0c
-
Filesize
83KB
MD5e9fe66f28a08cccce1f59dc061d4af15
SHA10d23681bde40315439857fbf74f134e8c3dece95
SHA2564a780d13e44d8fe24bbbe89550cc52382648b94e50470ecefaede12cf819bb65
SHA5126f84f5bb8a1c03976ff623328a4febfba0d9518e0d104a0d955c6332194077d7604659b248a427581de970f672f642f9bb7580a062675e63cbdef29300dbec0c
-
Filesize
83KB
MD5085dda4e01a457dfe5f11947d0ff8c95
SHA16974e011b5fdf91f7e4fc31fdf9a230c7dd0a841
SHA2568271ba2b3d5cfdf0ab2550842f8d559d96248d8fc9a73f6fca84ee91367e70c9
SHA51262c31b6bcf765a6ba66718057237c6473773f1c243938a16514eb8b36075bea19629afb8c9a59c85ded09eccc082e7bc4c1a6ebd497d49a64550c68a6c8fd5dd
-
Filesize
83KB
MD5ac074c69495ce60fa8d1d61d5f45d793
SHA1017a3ac87e0b7880713b1e0c5397c246717ade7c
SHA25614614cd395977811f808f417e3bd3fe007b7eed69b59c668d44e11e194b26cf0
SHA512970f6ac2ac77a65d28402a31ca7a560307ea5b2e9eb26e43565264916b9e9f9aaad5cbaa9f87cd4af67c6ecd0eceb8a93dc4bb9c5dd598ea001b0cf91fa2eb5b
-
Filesize
83KB
MD59014c021cbc8b9826dc5c5900cf5238c
SHA1ecd84e3fa7610aa39cc5c8a52b01616cf9987ffa
SHA256916d13ee37331a0c61521708080a816bc3b451e7541317fd0ab49fe3bbf8ec5c
SHA5127b3e11f9effc788d23cff6b63c7dea204b832a3c8fbb1e80c08e6026cdf5ab64e54489511f23a62813b534962cfe85ac089f4252169bd4a9567a5b2177ba21c5
-
Filesize
83KB
MD5a49c3c6b6d0777094e550c1a161a3dd5
SHA1be3e6d526fd7dadc39e36863c02af3b814db064e
SHA2564b9a2346ef00ceadf77888d0f8765aed5ffe1f8c8c4f4c90ec0f3896b6f00bcb
SHA512fb02be75621897d899ccc5638e42e3c0aa9fd34b4e90f0567d08e08955ad4a42d6ab24f6c219f91859b8150ccf6ad4a7df202e472aa9d778f120e4a45d96b471
-
Filesize
83KB
MD5f022e39a63b6c40552355e7702af1328
SHA19e57ab24bcc0de713825ee6a7d8d9eb3f4d5e698
SHA256221e34b74655ffcb8b12ed601cc552a6de11b31f4ff1ce98daabe9d70d318c19
SHA512029bfa1fde506331693b0404a3de8f12fef110703935d3b80a4dc9888d73091336fd213cfa826043a018890bf6c57d44f8eae2808202dff8a4ff9df8952d51db
-
Filesize
83KB
MD56124427bb2595495c9cbb689e0e8367e
SHA1820a0759f1750b5be25aac4fa7614329d2ed4a89
SHA256f7093fa0abf1c5582e765e620033f252441069ced4e7ced6d26ec9eade33285a
SHA512e082a39d5fe2df4a06d698fe0f7f3505861fbc0eec2f5462d68010a546cc703f89da4caf874b8a0525f04072711e8517ef835b0424a77b5c3ddd685a4d1d01d4
-
Filesize
83KB
MD51e6304f26b67ee499c812323e4b5d9b9
SHA1b296757c966b423c43c0c73ae56f6802e42e5ca5
SHA2565d32cd6f8089554aaf119e8ccb43f439750491f0ce15aa8e51927ba75352001c
SHA51267318106f0168bc75a2148a19e4056655ed81c0795dd231404d3a963ae9291b61fda22d6a053d969a755e0faf7010ba3453aadacbccf613d12882044fb42bfd9
-
Filesize
83KB
MD5b0b44ca4b6eea11369f4266aa58a0e99
SHA1e2ecae1cdb760f14a362979fcdd244f1afb3a8e8
SHA2565117ef23e8a130752b42f21744839a30f7006e3b62d1b83a1c5900a59957de44
SHA5123df04f358f9b1d9a09de2c8ff8f82b758da1607bef0e5bcd5207bd2ba1757a6bf2c53fe5203a015fdadb37b647a81dfa0da39687f7ceabc68cdb725abc8c1861
-
Filesize
83KB
MD51fe36020661ebc740999be57c53274c4
SHA106f5dacbd81f6b8034c7321cdc75c673f695c939
SHA256b44a50dd55a407d327033b614e6822f819b77f28d0a571548df2830bbb7f9e34
SHA5124f4e32893cca292a421e5bf6e2b9c17e82742e6034bb0512a3fb055aa687aca465126e405de0d04bd35292252ad3f86179db3654ffbf59db59626e4e9088e5b9
-
Filesize
83KB
MD569aac9cdefe6b4d3238d4dad89e77b6b
SHA17c2c374fa1930e990a7842816ba8feb37333e6aa
SHA25647648db11c2dd3808d02ca613e55fe6fd7d4ab86ce7671a4da41ac7a765cc694
SHA51256df22ee577883efb647fc63752f2b1ae7bfa0058d67b5f567429993e4c3bfc4754a34aae765ce5ec576e76f3a0a31aa86f26ad09513243889f4e404d6d0e96d
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB