Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 02:46
General
-
Target
ec879d5683c1ab7c3a382cdc2ded69718a293fb673674e18229358a31f970640.exe
-
Size
60KB
-
MD5
4113fade3d2e3a7cb4fd9ab8f3079c8b
-
SHA1
35d13be358add2dd6fbf1ae2d107888a1e643f4f
-
SHA256
ec879d5683c1ab7c3a382cdc2ded69718a293fb673674e18229358a31f970640
-
SHA512
92d3f8e2a515446f763b12bce7d39ce6cd64bbc09d53b9852409493f3382f7743d2c6fad358a7a71966a7a547635cd3853f73e3498df0f793ddb2a59047d9e27
-
SSDEEP
192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwpfY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroz4/CFsrd
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec879d5683c1ab7c3a382cdc2ded69718a293fb673674e18229358a31f970640.exe"C:\Users\Admin\AppData\Local\Temp\ec879d5683c1ab7c3a382cdc2ded69718a293fb673674e18229358a31f970640.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3FD6AAF-7634-4460-A58C-69397A363186}.exeC:\Windows\{C3FD6AAF-7634-4460-A58C-69397A363186}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86152526-DFE8-4fbb-8AD0-B146B943C23A}.exeC:\Windows\{86152526-DFE8-4fbb-8AD0-B146B943C23A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{229B0334-FD93-44e3-93D4-DFE4588DF576}.exeC:\Windows\{229B0334-FD93-44e3-93D4-DFE4588DF576}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{375E180A-01DA-4728-BB46-3F08F991E226}.exeC:\Windows\{375E180A-01DA-4728-BB46-3F08F991E226}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8195CEE2-FB88-4eb4-9F95-8E3BB4333C15}.exeC:\Windows\{8195CEE2-FB88-4eb4-9F95-8E3BB4333C15}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{62C2EC18-84AE-4721-957F-D6F5B0E3E554}.exeC:\Windows\{62C2EC18-84AE-4721-957F-D6F5B0E3E554}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D37F9010-BE66-437b-885F-969D9C2B430A}.exeC:\Windows\{D37F9010-BE66-437b-885F-969D9C2B430A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA25EA72-7A29-42ae-9925-ABF3FF0D96B1}.exeC:\Windows\{CA25EA72-7A29-42ae-9925-ABF3FF0D96B1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B133F823-7F85-449c-99F3-36CB0D60F366}.exeC:\Windows\{B133F823-7F85-449c-99F3-36CB0D60F366}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28948893-ED34-46bf-872E-6B873DCAD77E}.exeC:\Windows\{28948893-ED34-46bf-872E-6B873DCAD77E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F788372F-1BDD-4df5-AFEF-FB3CA8F9E64A}.exeC:\Windows\{F788372F-1BDD-4df5-AFEF-FB3CA8F9E64A}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{4E92096D-2E89-412d-8CE6-BE8C81000553}.exeC:\Windows\{4E92096D-2E89-412d-8CE6-BE8C81000553}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7883~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28948~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B133F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA25E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D37F9~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62C2E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8195C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{375E1~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{229B0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86152~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3FD6~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\EC879D~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD5ac162101f0fdd59fd98bf00d21a9f11a
SHA17408a91d7ffefe8c9fb253cdc8bfa6a3a7173e95
SHA256295950c6e494d628d86a351f7e31f0a256d6a2cde38ec446ac2e0b4aeb47dc13
SHA5128b55bcc6eded422f52033186b7bb847777f8844a2c3c1b13884ee62fcebf936fb2d57480ad66dfd2632a841d8eae0bfcac4097b157c70053dd4ecd7fb5664497
-
Filesize
60KB
MD5ef71e6828b28faa1b36a9992bb0b3d18
SHA1772072726e57d047136d4768f6d4aad9770af4d7
SHA2563b6d1a13271de023e6ef9400d314d7ec7f4e9f99943bcd16dec94a956d57bc03
SHA512b355c555b38c70702a66b3941b385ca0925adab6151f3383a4f7ebf3dcd9f5a6efac264a66f60655ff6677bf5273ba58153103a56b212e0f8f4d1b834fae4ff8
-
Filesize
60KB
MD5f7def15bfa03db66ca0959d18128a17d
SHA14f45df080d4a9805ad94b5ec84fc32594e6002ec
SHA2562f1c13cb3ae9f6c242ca5c3ccfcd3da950d867a43be756dd48145d48b0180ed8
SHA5128ef0e24c2c9bf6e0efaad8c7932d8d23198deaa0172eda57a0b18e4cd0c68478a355bfcfbea02f16bbeeb0aa1205099f2b311f6c1cdd50ced91061fab78aa380
-
Filesize
60KB
MD5eca60df6812f26c768907a46ace1f242
SHA14992360d9dffcdde54787abe5f54829231d3559e
SHA25608bcced966afd6ecd98acd2b58c2dca9e411f898c8cb9dcfb53afe917bd73c29
SHA512448a25522e9f92bfaad4a67832af8190384d9767bd1fa8a7c8c9124cabe220919a6b2a6c8bfa73e027725119c7d3aea53c4bd3149fb555e6a86e353945efee26
-
Filesize
60KB
MD5504b7904cc31bfb4119b45d3ff51ec49
SHA1b5a048f773b21e999dde583f16ec186df1064bca
SHA256087f9fdecc4314ec0e4e121d7f5e8315db9bfda443d1615722c96e3d6e9e1e90
SHA51242b9d0911b9c219ed9b23d258b956d8a38817558d3e6b906fa741028a34a7993719d61c83d204f5dacef4c8e238d22efbf030d9d25db6eb76a607596a4160166
-
Filesize
60KB
MD596582e0b9c7c5eb831396ec7986e53db
SHA191bf28febd6e94d3f55f6d1f68074006e2acc707
SHA256a6574c005d8e4b0f39b11425e8dc223d6d0b86bf0a3c9e7443e05517324f5e64
SHA5128bcab37c9bcf30fe5f043b08ea2f0a5a31ddbb97c5ffe733eb8bd7935a8aee5d4f807fa6ff8c9e83142b52c7e956d0ac8ce7fa84f3568a65299051866eb11674
-
Filesize
60KB
MD583047b1e89593e6167aae1ba5fa95fbf
SHA1627233efb8a6b0b7e6dab958434e96d109070257
SHA2564db6c4f4c36d7502ba63c6cd7334f8d14236252d0a905d053443920c37c507a7
SHA51299c09ce200f500b20bac417295a21f9253b73b9a5de52e165b2a0e0b6416c50573e6362b8fc5dcfb7e9636d6c7ca1cc7d20681145f5c05cc67d2eca4ee2c8131
-
Filesize
60KB
MD5611b2ed6781ccd2c7addb7890de89c7b
SHA10473bd554be93455452e145f0471998e184dfda0
SHA256b222430f0061255b7b599fe522a1fc2033c33de8b79088ecd42be10cf679fd56
SHA512fd3e9ba2eb0c830aa2d58797ce6c544a46be01257e3b72321e2e9df53bc46871b43fb0be5005531ba3df73b292a809139671625013b5c0a631bcea24691e6f4f
-
Filesize
60KB
MD58478064a8ff781cc0a258d2cdbed379f
SHA1461a4832cc84c8e6959321c4c74ead60ed4bea0c
SHA2564113aa31dac2a3f48d1fe10773daff502e79719c757e7cc0234faa7a52f59c66
SHA5125c5921ad06d252808d5b1fcb895dbd6e7c0fae814353e4abcf4b776f293bb58aba51bd198e5eccb2e4a0bae0ce09b19025c971479c7ec571a368f1201f4a7541
-
Filesize
60KB
MD5201074ef2d05d620dbd9613bf54fe0a2
SHA15213fb9cb857c08ce1ded300906b2cf562feeae9
SHA256d5fab8b7165c5ce3ca0dc9bba7adc385ea0d0c75b6588c2ce276ab6cabd2eecd
SHA5127c44d6e5978c37278309aad6dd79311cb4b2887f4d4fee78f9ee6e4c32bddfa697f244bb1a7ea344ddd371c0c805d423797d528f84f575d9efd4421ea21645ac
-
Filesize
60KB
MD5bbd9bfa825e2b85875c0be5a38c94eb4
SHA1a524ac433b1d6c8ef94eea10cc0b779cc5928467
SHA256a47e242bd86d21f54c98ab7dba3981b11ef78e6a9878d1821326814d74e867d2
SHA51267b4a1184385902d5d06146898f435a8c9e5fd89aa47ddce08ab413eca152f98b6dae3c1bc30104d1684fa967824adf27a1b8b0f0a835d9b1e9a735c57d158ac
-
Filesize
60KB
MD50846125f361467721efbea01259b1308
SHA1a3058a91162ffa34ba291575a749f25e8ea575d3
SHA2567eb878f773f0bfe4cdbf727e111223f1295e71f106a37e2ce3aad5d149d743bb
SHA512b9b83540a0e460d013c0ec7ff3355cd35e303ea0654f934a6efcac296081369858865a4d1f507d0a22345eb7a948af0eb8fdc96cf2d6d107282b5fbc15d0a4d9