Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15/09/2024, 00:24
General
-
Target
7f55100ef1dcc55b97b46a2cf770600e538f6e3ba12f724a32fad9ee63f4faec.exe
-
Size
14.0MB
-
MD5
e2dc48609499a45167bfe506d753e553
-
SHA1
18ff37bddd7875c675aa39c7fffd7a0fa7100c5f
-
SHA256
7f55100ef1dcc55b97b46a2cf770600e538f6e3ba12f724a32fad9ee63f4faec
-
SHA512
0352faa0dcaa762840e2b109ed77c8f60a45267c3c83ac64120b646f7fd084cc69164a311627aa81d0c04ea07dcb3a83d991d393fc2037eb1ccb81ddae84a9bd
-
SSDEEP
393216:VJOPPpUs5j/CC9FWMYxdI4NZXOOXyMn9VE28IsU:zOJx6RM2ZXOOXyMB80
Malware Config
Signatures
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f55100ef1dcc55b97b46a2cf770600e538f6e3ba12f724a32fad9ee63f4faec.exe"C:\Users\Admin\AppData\Local\Temp\7f55100ef1dcc55b97b46a2cf770600e538f6e3ba12f724a32fad9ee63f4faec.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
511B
MD52bb27cc9ab2cbecfc4e8c37006918e53
SHA1a52d789eca2949324fe47999cf5a6e726b7c8182
SHA25683c1bfb07c8cebaf722971f20097cb23f0605863dcdcb1a1ccd62d025c6ad7ce
SHA512946da938a399290e5d18c9753747e14b93da427b02165d5273b95a8deeb80eb8121d580e79f6c6782b9822b2d9fb66f5e4927fd229ed4d0c5227f769bbf9ac70
-
Filesize
1KB
MD57d2440a282f3e64a3fc84d144e20f1a5
SHA16528b4548c23e6574fd5db4f123584d28738cd48
SHA256f990990c89915de49481773944a95d22651183fee58c6f12ce502c97e742890b
SHA51238b422fd407d3e3d5dfb7155d9766805dd1ab57a198083162f20908a002fc25151fb6b9263733d5721ed77799a52c34ea4ce526d3e5f5689ed54765453589914
-
Filesize
2KB
MD56014496e8f8985411a8b3920bc1e6433
SHA16d54070dc18c28e4307943d129165b0e1b6404ae
SHA256aeb83e0d1363652bd9e21686d33f6e321b4f53331369f2a33c7c6a3a00d19796
SHA5124d8fcbfbd5b9441a993ac67c73a89d5d4a8baba51984653e63e41bb47815313184c60874188e04b13214b8d10500090f678e822347bf2412bf401a251b50c783
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
5.0MB
-
Filesize
14.8MB
-
Filesize
12KB
-
Filesize
14.8MB
-
Filesize
5.0MB
-
Filesize
14.8MB
-
Filesize
12KB
-
Filesize
14.8MB
-
Filesize
4KB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB
-
Filesize
14.8MB