Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 21:16
General
-
Target
55878f2ae86d624d47ab9f9d2a17ddd82093d3bc2a71736b3c17e5516cc8092e.exe
-
Size
83KB
-
MD5
3f31419738594f62a08d726535d49141
-
SHA1
5dbf3634936c7cefa16f886bc0334d4063aec231
-
SHA256
55878f2ae86d624d47ab9f9d2a17ddd82093d3bc2a71736b3c17e5516cc8092e
-
SHA512
d789b547058fb875ebe79aa5ab5f66bb4056dda15f64303c1efba48535fa6716569fb21e30eb207f0075aadab6779767a68b6a8e28cf8e6355caa09c03f6d02b
-
SSDEEP
1536:q4Gh0o4R0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4R05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
UPX packed file 46 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55878f2ae86d624d47ab9f9d2a17ddd82093d3bc2a71736b3c17e5516cc8092e.exe"C:\Users\Admin\AppData\Local\Temp\55878f2ae86d624d47ab9f9d2a17ddd82093d3bc2a71736b3c17e5516cc8092e.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{315853B4-8421-4fb4-BE28-56AA4BA4B7E8}.exeC:\Windows\{315853B4-8421-4fb4-BE28-56AA4BA4B7E8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97D90738-7D5B-4642-8CFA-82C1754BBCE5}.exeC:\Windows\{97D90738-7D5B-4642-8CFA-82C1754BBCE5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C424EB8-8688-4e29-8450-789007D6FD34}.exeC:\Windows\{6C424EB8-8688-4e29-8450-789007D6FD34}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E4A6B85-BA18-48d5-86D6-7FB9EC24AE28}.exeC:\Windows\{0E4A6B85-BA18-48d5-86D6-7FB9EC24AE28}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE7461A9-C563-46d9-876A-A5C6B8F355FB}.exeC:\Windows\{CE7461A9-C563-46d9-876A-A5C6B8F355FB}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE3CB59C-5AA7-46dd-BE0A-55EAD500E037}.exeC:\Windows\{AE3CB59C-5AA7-46dd-BE0A-55EAD500E037}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99C6AF37-7637-4044-B51D-6E01E756D512}.exeC:\Windows\{99C6AF37-7637-4044-B51D-6E01E756D512}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{798C9ECA-1AFF-45b5-BB62-C9DE37DF97AD}.exeC:\Windows\{798C9ECA-1AFF-45b5-BB62-C9DE37DF97AD}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C3EB95CE-B2BF-4782-B3FD-67258DD97EFB}.exeC:\Windows\{C3EB95CE-B2BF-4782-B3FD-67258DD97EFB}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{59150BE3-A8EC-44c6-BC69-A8F0CBC1A153}.exeC:\Windows\{59150BE3-A8EC-44c6-BC69-A8F0CBC1A153}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{61481E6F-6B1E-4999-B85A-FE3D7F0B1BF5}.exeC:\Windows\{61481E6F-6B1E-4999-B85A-FE3D7F0B1BF5}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59150~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3EB9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{798C9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99C6A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE3CB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE746~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E4A6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C424~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97D90~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31585~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\55878F~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5360b14b689dae3fb0250a163474c0332
SHA1309d11fed6d30f75207cc1f8c52e42a60278c8ed
SHA2569d5628fc296483065905147c1adec88742d433d230f1d73124854b7ea5fe1a72
SHA5126986bc0ef2defbf7762eab7a29fa4bcb028da29920f0f79b61f305626e7182c5fcb6b31fc26fb4e8d5582c70cd3bbaa7c119a9606926ad6899b1046efccb8a16
-
Filesize
83KB
MD5f588ebdcf76da939b4c3d83b0ffb522b
SHA1399d5d7deaaaaa21a765fb0e4753f2aa4a73b1ea
SHA25616e6de44df445f8668e8c6ea3ffc680c59c237bb628a2fe833513687b3cebf4d
SHA51265f697c32c80b31be8079881e93516b0246da93be991f2c0f7735b1bd526242115e112978ab3a641df6731bc57ea5d4b20cf8a0a3e363e6c6d5a40b0c58f152e
-
Filesize
83KB
MD565117a9b3bbcbdf147b3670fc9f2a2a4
SHA16f93c1df955f33e94133b1a7eaadb66124321d29
SHA2564aaeffdfe8b55dd5b1003fa79a609df652dae1958df0d4b4d1c186bdf59e9339
SHA512abebbf24b2c66b962f3c85e12d479b7dbee30e98797a3b89bb819e0f2b3672df745b4eda3661c026b6e7f3a229d263d82936e6a2c47a5afe987d439d9496d317
-
Filesize
83KB
MD524734952309d7d46a5fc6beb938431e3
SHA1407f51f4e1f20f6330caef2f8254e99c73abdeb3
SHA25623832a9f3ce0190f45c756915528534f7d9daad06afcfadb8b1b9e60516238cd
SHA512867b0f7def2b84272b8c4006e42c3d57fa6d9cc81949ae6a2a6f7f3e054efb9dce87b1cbd7d639650ac2e21f2292221bc31d23ab07419943301a621e1fdc1858
-
Filesize
83KB
MD5a8bdb89f0a704e3cb91f4646e18db1bf
SHA16a65462a1a0644cd0337e32fbf97d8d62e9a640b
SHA2562e4de23047881931fbd333ab8b7d055abb5c4374a07b09423a02debd58bb8bc1
SHA512edb19c11b9c9eddc3a7b5ec9b06f7c9ef383263e85a08d35fa149f503e31013242e623d92ce9de02ebb573bdff1dfe40abb94bbc6efc5ce00ca2faedde79fa6b
-
Filesize
83KB
MD5fc366e26780bbc2bace875182faac121
SHA19ea5424e0ce3f5d299b992b69bf423dfad7765a1
SHA2563c03a91cf7183e0a68462c1d0144f248bf7f77df97e3d10a6e4f47e56c56d7ef
SHA512b7c74ee434e3753d7b1ef2a2ad14c1a7aa8fc6ea4058a937bb827811a500c13aed40a5d57a1a2ab22a50d4c3800d7a336c658af1523268386e6b7f3c044fdf2d
-
Filesize
83KB
MD5c108a449be7e2a43f96c29d3cfaa545d
SHA1ecc92525ab6849896d99af2e7269306f1525c3eb
SHA256bb9ce3ede95c67194178a3f34e88bd46fb835e4df9ab06895b1b240e5783a8c7
SHA5128a1c7805124173db408c49c020338bcee7c04b4c283d163f91f4b94835cb23102d34eb1013b483fb2e0975523d66d116ff13a6ae0d4a2291412009f01ee0db28
-
Filesize
83KB
MD50a4dc371c36f0d92de0a76afb00b071a
SHA1b8f44bd5f7c28f75958e3446dfd5701efd5c7afb
SHA256aa9c484c94ccfb4a065955cb3dc795a7bc397eee3c9efab2b9accc7062b00a84
SHA5120b0d0079b93eb774f38598db79de98cd6e1689c8f640ce5fd21ccd5cd54ac6330db0c60385478d671575df2b69e4e4560730b9320f07a2cd258ff7cade9e1e75
-
Filesize
83KB
MD5f9fa8a2176841b897207569ccad3b812
SHA1364c0e01b6d5f49f2926e3a6836ba36b76280ab0
SHA25657a5c745b386cd22ec32fdff1a75ab045e8900b1ce6507641c5fb9ab59784f0d
SHA51247e7bd475ebe056b46a5d7f0d14461b0aae6e3d7d48c2a3a41f97e416510969fc2e2b22a6f7a50e6ccb2a5ad7cf9c75bc2dbc151d18d6cdd95d6fe90088c5dc5
-
Filesize
83KB
MD57d51fbf6eaaed73da4dbe280e24479e0
SHA19a8974e7d6b7ac81cd79b93bdbf18d2deb74a9e2
SHA25698fb191a4d5fd60f65039fc14e61a424d134e03640bde9059f6b9998ee2a4e1a
SHA5120d10a219198a4a0fb323a9d2aa1389f0a7cd74191af5fe34c8ff622c9ef6976429ec049cedc57f842b77b1e7bc784faeb3528e59d4fc8d9f9471f6bf43661e4e
-
Filesize
83KB
MD5e0edd5bac9f238b2601035eb980d9058
SHA1f4d7c24ea67507f8170ebc91f71bb38c72431ef7
SHA256b71fd04ce9fbabd4503cf56c9bb14278e8a0ee859dbabc9f6b7a2ab6ed998177
SHA51227503178acb0b43cdc97c02a6654587accadc60a83d5200fac40109eb101550d0aeff826c8da0d5e68f476b18681e727ce680a3c91eb9c775d3205119e55a5b8
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB