Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19/09/2024, 02:52
General
-
Target
e3dec76ac5f57f9aad07ac8bb126a94efe9d4fb083e1fa20f1c2c4aa20c7e9e6.exe
-
Size
83KB
-
MD5
63407b58f2b87a3fe4a61b87445c8d9e
-
SHA1
bd72f9ffade5451506812dd150821a911ba33778
-
SHA256
e3dec76ac5f57f9aad07ac8bb126a94efe9d4fb083e1fa20f1c2c4aa20c7e9e6
-
SHA512
aa4544d00b1fc1706dbc97d3b83f7ed6acaff505e55e5ea030a33e6ef15d8a2115d98a74fd76455af1bce5f9193e0c966a196346606e35ad66073bd5a57145c4
-
SSDEEP
1536:q4Gh0o4Z0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4Z05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3dec76ac5f57f9aad07ac8bb126a94efe9d4fb083e1fa20f1c2c4aa20c7e9e6.exe"C:\Users\Admin\AppData\Local\Temp\e3dec76ac5f57f9aad07ac8bb126a94efe9d4fb083e1fa20f1c2c4aa20c7e9e6.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E3FBC25-A688-4e1d-B272-CF6ED762B9B4}.exeC:\Windows\{0E3FBC25-A688-4e1d-B272-CF6ED762B9B4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{494610E2-869A-4ef7-9D35-4CA8B56F353F}.exeC:\Windows\{494610E2-869A-4ef7-9D35-4CA8B56F353F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E10CA686-5CCF-4fa8-903F-391066AC2242}.exeC:\Windows\{E10CA686-5CCF-4fa8-903F-391066AC2242}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A9C79EF-25C6-418f-A205-919BFCD4FF74}.exeC:\Windows\{0A9C79EF-25C6-418f-A205-919BFCD4FF74}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{459B1A38-9978-4883-80C4-AB7D3C9D130C}.exeC:\Windows\{459B1A38-9978-4883-80C4-AB7D3C9D130C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E2B40FC5-B4C3-4e36-BA4B-88582139A147}.exeC:\Windows\{E2B40FC5-B4C3-4e36-BA4B-88582139A147}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA09CC1E-1555-4d55-B993-A62426DF0693}.exeC:\Windows\{BA09CC1E-1555-4d55-B993-A62426DF0693}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D01ECA5-5794-44c8-8615-C8D5B311BD8A}.exeC:\Windows\{5D01ECA5-5794-44c8-8615-C8D5B311BD8A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F9F77EF-441B-4842-BA81-3342151A2636}.exeC:\Windows\{2F9F77EF-441B-4842-BA81-3342151A2636}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FB3343A-040F-4710-9934-40473C208317}.exeC:\Windows\{5FB3343A-040F-4710-9934-40473C208317}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E03DB5E5-ACC2-4cd4-8789-219BAB5AB83E}.exeC:\Windows\{E03DB5E5-ACC2-4cd4-8789-219BAB5AB83E}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{3AB28DAB-12E5-4d5c-A19B-757EDE308861}.exeC:\Windows\{3AB28DAB-12E5-4d5c-A19B-757EDE308861}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E03DB~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FB33~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F9F7~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D01E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA09C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E2B40~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{459B1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A9C7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E10CA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49461~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E3FB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\E3DEC7~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5b6085f184655ff083d6642f7b27eb648
SHA1100c7fa72a5501445c1350efad970127738d7867
SHA2568d1213bf164f1202ce43edb464ae69174d4d46f5c9e355cbeae43eb2c1414f5d
SHA5122c1970bcec12eecbba3b91f9689b2027e0889a6bdf864576ae3e661e0ab99880d5de2e5c8409e30fc8d5c773682eb927bc49910252489b838b6fc343ee2abb2e
-
Filesize
83KB
MD585cb54ecf7b0d40de173ed9ea1d3bd55
SHA192d7b2c584cd34fb8b2415f3a4681f77bd18eff9
SHA25617f16b3b89fa7f6384f1597152a58038f9126f76442b63b292e328b67a8630e4
SHA5120e43bbc42dda09bfd42e18bdc93b1e74b73ab5fe4c3898fe7b6e1295b8e4bc08c5cef02c700d8355a6378cbd89341e5e9b8e213f79ed83812dbeb9d754c54d4d
-
Filesize
83KB
MD5b36ce882402ccd5becd9ce3c111ba022
SHA19adefc57ae75fe6809c7f4033f9e2dcf49836310
SHA25696805cb3546282a87fc51271c3aa4ad89e50bc23ecbdf81f7991903a9a89a783
SHA5122eb09f31ba1b9836e0c8638e574564f3222f990a2fd3aaace41a6931d2c0f794d7f66df94053da9ddcfa81f178e9292c1b7ff482175be9cfd9d15eab4b981464
-
Filesize
83KB
MD530635d29c47ddc9d7918e1262a08461d
SHA1558de31086c069669816e6e961a7c7247e35c71b
SHA25633a9f038f4a7a950ba4ca17607b9222935c2db08d257b48486d4e3bfc6d5d5e4
SHA512e56d87e5c895c5483a1096a69f3aae418d19d41361599f9b291680ce5455e402036bdd7510d2fd38033e953f8f2f13c7fbad0526a2ca1b256c74e76fcd50c8bd
-
Filesize
83KB
MD559404092ef04eacdee7ec9893bcdb2d4
SHA1ebad08eabc35ca4411527039f9d59bfd67d81b14
SHA256b8257effd1f2a1a0ded906771612deb471c3a6c76371896313668dc392731806
SHA5125c3eb8ea847e10eae1d42fff5b0a8ea5f6dc24a0ae601a170c21c4bac106ab97929e97d28fad9794970cff98f117bdaf865ac944e2a3f5ed75231acc339415d5
-
Filesize
83KB
MD5790bff604c6988cb7d98eef4ded1b775
SHA1be99a7b993000b2c1e484e13a3f4d336cee5edbd
SHA256d74dcc39f6681a5e92ce5263a44dbeab8208ccd920e507641d9925d7a8d12e46
SHA5122bd10816ee092ea4e2904cd70ec93086e3516a949d6c09fa612728bc2e03f7a9a9867086dd6f2e997e88f34aa4db9a83432918214ddfd826eb8afd562fe5e180
-
Filesize
83KB
MD596feae7f7e7d403dbd280a9b86916639
SHA186885ec9e1cd541c628e22a933f5129270c130c1
SHA256d074aa3faf6d413cc4ee2458b4a537406ea0aa4d284bb9a1de51088c3428fe9f
SHA51278563b729a90a56043a5a65dc95fb519cac223c818ffa0aadfa85c9b5740f68951283bcec99be7fa7c0bd74a90cf68aeddb3ed54081c68e7be477cbfd7259ea9
-
Filesize
83KB
MD5efa9dc50f754906d7ab14ba369fb0764
SHA177f9a342de40ea85cc3b2a64611c7848a4a23bc0
SHA2561380c5440007080df6ec693e06764a5a7e20a0250a2e291cc5e9d4dbd46bd283
SHA512c768a8d49caa455e35031e754bfde63cdf2a635bb1a449bd4fa221b89fc22e95a20e42c80407afcd4bf5b7559e7cfe302cabbd8249b1b81e9da27c7adc1823f2
-
Filesize
83KB
MD5c030382447b35c74df40e3e411e154b1
SHA1730eaba67ae1aa40b5ed24fedbd2f45ea0d95c72
SHA256fbb430e2265eb976e7610474d3b447b95e5a9bd6a1e3ef6e3eec3508885a9541
SHA512e8562ab7b5ad3b0ca2c2647ff14e016782d727f0f3ca0b3fd2f9c38eb281a1a0f0135d6e46e694f372e4ccae928e92905192beca98e907c384ae242ba58db4f9
-
Filesize
83KB
MD5804183439f20ead4619e9113afddf6e2
SHA156cd6b87e55c08777098d6949f7fd261330caa44
SHA2560c43b84215d84709262f9162a13b0d936f22f805aa0a06e359ba3da3f7f3332c
SHA51258a38d386819ffbec3f0274e7b1185fe665f332dd281423ed6ca402b1363c3555be9ae2823bbd7c095064ad4fec50ce26d1ae15e670d481b323cdca8b6754b9a
-
Filesize
83KB
MD5982888141b50cecaf0abc79ccd0fb3f6
SHA1cbe565cd09046c1f6d921d98b4e789ab8d4f952a
SHA256eb850f5c8d91047fc77d3bf0c9fd75d8e6dc4013a766598071426cac7f20c630
SHA512b82c22611ec6f1bf5c205953af40d48df68591ab4e7ba9b544147463de9c92a904730fa1cdeddc8d0965b05fc58dd66fcc25320113a3dd1321b5fff38fb466ee
-
Filesize
83KB
MD5ed92eda19e1a436c143632ca1221f7a7
SHA154cec747859f66c33b5bc3fde7a2fc1e6b4142d7
SHA2561b67224b1f541296f488d32dca3ea3d280ce1970809eba7cc34bdf47bd2ccf3f
SHA512c9f79960b18e5a6301c6fbb14d652d30e0e135d8577af0247481a1416f6a90a25c2b34cfc9b683438577d32dd3fde9e7b8bb827afa6518dcdbab795de96bcecf
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB