Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
12-09-2024 12:58
General
-
Target
a63a260c0835f9922cb6913205c8e7574af2404451487763e9b083edc6ed009e.exe
-
Size
78KB
-
MD5
b7318612bf7baaac67ab870665fefa0d
-
SHA1
14ae55beca1029bec01f88ee037a2095c6c0f451
-
SHA256
a63a260c0835f9922cb6913205c8e7574af2404451487763e9b083edc6ed009e
-
SHA512
607d7e587f514b27b71493df26d0916389fb539dba99f77aa6e3262a2374f640b4688438cbca6cb8417ea70f56ca87e5e395398e35a4b4098e7ca4fea1266a84
-
SSDEEP
1536:RshfSWHHNvoLqNwDDGw02eQmh0HjWOnn:GhfxHNIreQm+HiEn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a63a260c0835f9922cb6913205c8e7574af2404451487763e9b083edc6ed009e.exe"C:\Users\Admin\AppData\Local\Temp\a63a260c0835f9922cb6913205c8e7574af2404451487763e9b083edc6ed009e.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD52d20e8d2757f87b45a5639bcbcb8c6d5
SHA1948fc3a31e2039dcebb7962b9b6382054b089293
SHA256c2b437b0903e0e46706305d39ae2cb518a6ea0f765a779967cfcde894ed72133
SHA5121942c16957e9060a5f2f6f9d7758e8e18ca10be8b442e27c5c78abc6fecb6b0833c610d61691c0a4d8ae284212b841b1ba769eb955e7f07243ba40f17aedb21e
-
Filesize
81KB
MD512e8629a45ccec9c7500d9bfb7bcdb5c
SHA13141b3f1798741fae9bd4366d73f87725494244f
SHA2563d45a6455e76eeca09eea3e541696daefac5f2c36dc5e7853fd00f85bc40ec52
SHA51254e1f4d0c5e541b9a0e235e34502d9911796768f08c54da6ceed19a973ac5478c4c9e6154676176473ac86ec07d787e121c9e062b686436618ff19c1631537cd
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB