Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 02:32
General
-
Target
0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe
-
Size
2.6MB
-
MD5
d2d299317746466f249c1bd3770049e0
-
SHA1
992612fd7397e5973e138bb3c780da7abea2f3d7
-
SHA256
0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0
-
SHA512
45095e730ecebc198fd4853bdd535ed498cb0a1a6f2dc5c1852ef56d0056f343b7fd461afc9c96e571b701871f62c3f40df95b5969fe78d594066d7455441afe
-
SSDEEP
49152:TeS12nRc6C5CEAHD26ICQVt1ULUQRP6a6YPkCLJ37xbIjNyX5Hxzl/M:6S+c6ZEmqCMtmoQRP6aZtnsNq9l/M
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 30 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe"C:\Users\Admin\AppData\Local\Temp\0161442d409f433f68eaf4f3ce31b4e28ec8a65cf01b516bdedcad35609798f0N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD5afb0d294b2de5461277ebe35b4587fc2
SHA1ed6cddace4b2913b5bf7a942df3989eac85f71f1
SHA25689fa9a9b6cfc0dd6c22fc6db49af432e4268a011d4303a1cde4a4e05594a76a3
SHA512af5835eba15abaed051ec289d62c3812f8d09b5dbe73335d164bd4413369977df9b9679f8e22ca4d87519ae29bfc77bbe23a193439f4ef08cc97c9053a5c2598
-
Filesize
2.6MB
MD5c22bbca7441cea0c65b3fbe0153eeb0f
SHA17b655abcbf8e7be6d0a56958cc8a93d7145f7dd9
SHA256a9ba862a0907251f9b231b0d74cc94fbabb533618547259719f424020249bf74
SHA512aee1e30ac659be9b77b2ef21b4b4e0dcb7c4e3aa52e5949d2d3525764532e68764889b8915436dec63b88d15f014742b6e8a67e7b768dc9c6795ea02fc8c1a68
-
Filesize
2.6MB
MD5db8a9e7e42a04dc1d2adf80b6db63fe8
SHA1cda01ddc0214e6a3583745b11d20fb1cb26014e5
SHA2568694f8c7c47a3a53fd911d337980071f1c647bc03f9b4f84ebf8af4a9a1e1197
SHA512046ffffc298e422ba76be4a8853d79033299987a59ff8d3e5e814517c730e7fa05988c919b4f5c5c3e85e8c318627ffed76dd478058595520b65643c25b5235e
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
9.3MB
-
Filesize
3.8MB
-
Filesize
9.3MB
-
Filesize
9.3MB