Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21-09-2024 00:00
General
-
Target
a2b780eb141c711ffa2f8da8ff3df7d2e9109232bad7630d5cb0f450fc928c3dN.exe
-
Size
3.6MB
-
MD5
24c344626fa30b02c6dd357e8aff54a0
-
SHA1
0f295f350e2c0b0d772010b98fbaed3ba8f12074
-
SHA256
a2b780eb141c711ffa2f8da8ff3df7d2e9109232bad7630d5cb0f450fc928c3d
-
SHA512
45386e27f66a5ad950993d3cb1b91e8bbd49206fd0ea16aae491ed6eab8b235959f9e3b1b2ec4209c7c0afb12258fc52117391620a033ea80acf2bbd4c75af5f
-
SSDEEP
98304:ddByXcdnlLwOrI5Vfeg91hZOhkRpsinj+:ddien+OrFuBR6c+
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b780eb141c711ffa2f8da8ff3df7d2e9109232bad7630d5cb0f450fc928c3dN.exe"C:\Users\Admin\AppData\Local\Temp\a2b780eb141c711ffa2f8da8ff3df7d2e9109232bad7630d5cb0f450fc928c3dN.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.6MB
MD584276b88aceb0f78e650ebbfdb40125e
SHA1e6d3dc1be20496cabfcb198d21388abd9d2d4bdf
SHA2564c5d770c801f27bdba3f1aadafb3b343728fb29eb00c8e9dc4c3b084462f4b5b
SHA512bef01ca01e6f996cad7ee8522d11dcef9ae1c1643b860d305c65bb9d6f80ae2aebb94cfd41dedb4d67286520d9cdb76c8ba7df974c097d53955451ac2183ff6c
-
Filesize
3.6MB
MD589e0e3be1d4ee7124bdd16707aaaaf50
SHA14254ff4d06e8cb890f2a6b9b5de1856a5f6c71e1
SHA2561e24ac361db8b81330cc3bfb222f2ec4914a23fb265753aeb76b29e783663b8e
SHA512d271812174463cb2bb7e8af55136397c3a63fc7d7da1e2516df4dd26e7f32d08dcd8edefb9d80bfde87bc57b299f867f5f560dd59f9754598f3a4a1c806e3f69
-
Filesize
3.6MB
MD56986119674c4200c8fcf0920c95ae836
SHA19173dd9308bcfcfed117a6aa403767a5653aa9e8
SHA2563ffd4bfda6b35316b833c50894600ed754cf8862a7642cf9b7bc9dae424c64dd
SHA51276471ae4d6aa6fba19615f23d157832c378fc3a66c589c2cc4644f0fbe1d08ba5a7198df1dc660500ba198c10e4e656fe752cfe6581c4129f03ef873ebc8306f
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB