Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
14/09/2024, 19:19
General
-
Target
5ae094e151d4970d4714e445b52c692c07f808a7c3027fcc6d1b6447fbbcaeea.exe
-
Size
13.5MB
-
MD5
cb392fe3d6436af38f2f3952aeca380e
-
SHA1
0c59ddd869824981ea479faab4ebbf50bd40b50f
-
SHA256
5ae094e151d4970d4714e445b52c692c07f808a7c3027fcc6d1b6447fbbcaeea
-
SHA512
bd468c89cdc76a36a1233e085111d602aa9eb5d78d53f67c8ca5c491d6395461e6469b843dabe651c6ff7042e82f9d920b10144770c76f8f9c73b7a0539c24ce
-
SSDEEP
393216:1JOPPpUs5j/CC9FWMYxdI4NhA18eIvkqKW:TOJx6RM2hA18eI4W
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae094e151d4970d4714e445b52c692c07f808a7c3027fcc6d1b6447fbbcaeea.exe"C:\Users\Admin\AppData\Local\Temp\5ae094e151d4970d4714e445b52c692c07f808a7c3027fcc6d1b6447fbbcaeea.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
605B
MD53baeab4446f8ec614da4cdd0dcafcdd7
SHA16d5ead5be943f1d5afd0bdd1d66d2c77efa8b40d
SHA256c46c6b9125b6c73051a727cecfd600168f3af9e893826ade5cb0c03fd41e2a03
SHA512d641de5e8ba9e16158daf9b2a81d1f9920d1b8b8f0517ae332f9c7f4fe7d3338f01ae52f11a92f6b233c03a95b3bc724acbf98953b960faee56a2924c5d2b110
-
Filesize
1KB
MD5f7d3a0013af680d7d602da1d14d955b8
SHA154f0d843c3ba8963a662ee6e89d581b20405740b
SHA256f7915f3d4d91ef4b59c297e52930f9bdc24abb21ad7cca12e9eb1f6d9fd0fae3
SHA51235d054ff5e9c088fdf6394a0d10f6a7d5eaa0aa76052399bfcd837fe1e525cc7fc2c445059a5981afb556a9725b718ed876a65432f3c2ca81ae012a10d0cb4df
-
Filesize
2KB
MD5012eeed3ad652e353ae4af4a88513580
SHA1fbb59a5971997273e43ade79a778e72b355a7ee3
SHA25629b9fa29fb5346bf094302a72ff11d61ab16d0bdd06f1643f6e44bbd415d2fb7
SHA512aa75935bf231d0359faa471280ec5155b6216727149f255dee94c1b6a9e8e944e6ff63badab0b3c0ac08dcd993c868af6278619739649e1a0a0343148d36ae85
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
5.0MB
-
Filesize
14.8MB
-
Filesize
12KB
-
Filesize
5.0MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
12KB
-
Filesize
14.8MB
-
Filesize
4KB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB