Analysis
-
max time kernel
118s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
25-09-2024 22:42
General
-
Target
78cdbcdec655d7fa5c1a2084c35dc4153726146fdabb733e23b6a29ebec34093N.exe
-
Size
83KB
-
MD5
8f457274d83c39717e79f3d1444dde60
-
SHA1
aa4ce4d3c969c65a24ef0880ddf6235f9462285a
-
SHA256
78cdbcdec655d7fa5c1a2084c35dc4153726146fdabb733e23b6a29ebec34093
-
SHA512
9c158c77640640684a2fd750d18a5ddfc72adad0486062cdc6a8f7dd83e57e413e065c483f2cac8da6b6dfc908dbb34a89ffd27e25d3e52cb2830c296bf964c9
-
SSDEEP
1536:q4Gh0o4g0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4g05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 9 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\78cdbcdec655d7fa5c1a2084c35dc4153726146fdabb733e23b6a29ebec34093N.exe"C:\Users\Admin\AppData\Local\Temp\78cdbcdec655d7fa5c1a2084c35dc4153726146fdabb733e23b6a29ebec34093N.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C9C1A002-AA03-40f8-BC80-B869FF7B3FD9}.exeC:\Windows\{C9C1A002-AA03-40f8-BC80-B869FF7B3FD9}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A17A2000-73E5-458b-8682-EF4AABBE3B23}.exeC:\Windows\{A17A2000-73E5-458b-8682-EF4AABBE3B23}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{386A0770-3AA0-462b-9754-968FCC6E54D8}.exeC:\Windows\{386A0770-3AA0-462b-9754-968FCC6E54D8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B257002-A9ED-4e81-9728-CC82471753C7}.exeC:\Windows\{6B257002-A9ED-4e81-9728-CC82471753C7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7758498-04AE-4079-9787-604D28DBABA8}.exeC:\Windows\{B7758498-04AE-4079-9787-604D28DBABA8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AEF8E7FF-BB26-487b-9978-F024D385FD82}.exeC:\Windows\{AEF8E7FF-BB26-487b-9978-F024D385FD82}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20FB7981-C4E1-41f2-9E81-38B8B928E5FF}.exeC:\Windows\{20FB7981-C4E1-41f2-9E81-38B8B928E5FF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB245EC8-E567-4a48-B604-2B7CC2406E59}.exeC:\Windows\{CB245EC8-E567-4a48-B604-2B7CC2406E59}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{06E10833-4027-45f5-8DE6-8C79956F379C}.exeC:\Windows\{06E10833-4027-45f5-8DE6-8C79956F379C}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB245~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20FB7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AEF8E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7758~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B257~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{386A0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A17A2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C9C1A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\78CDBC~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD5773d15da0021579d9c7531738367c5c8
SHA1e82545ac3379766d5178500d75d6e5aac90c5e27
SHA256929b27fcbdb2271576c373a29e7672e2967d3ba36eccf1f13c4c755e759c31b3
SHA512f308075b858fb96aca435cbed0be5efa247f81ce7b015d827a4e6bd4934b1f94b0054c1ccfa27962ecdf344d7e5d16cf380239147d19933a219959738a12e419
-
Filesize
83KB
MD507a3e2c4a04558e1be765586b476824c
SHA195489f42e53cc9c9f69e6fac8614b7ccd70c253b
SHA25602b9a3d608b9d5f8b32bce8de245d6b6ff55d7f5a0f3e18ce3eb8421b1458a89
SHA512e19d3c41a0b227a1af75b710b8b90156770acf6f8d0d3b1ba43e5bdca293e0971c75d3e93510de5ba09eafed6e73b8929d7bed3121ef247f0bd1c770e842f8d0
-
Filesize
83KB
MD5a11248fd18caa9d67d760d3e68e411d8
SHA1a0d3840c253cb28d01449d1df847ad32269a645e
SHA2564d0cde9ba10b4ee175ca9eddb8697e96c3ff600aa959ccca32e06c4bd115b227
SHA512ebbab320f7e386e46af0c2394269a22d2183169d8bb65fab8f6e3e38577215af56832e326627d0e3f3ce26d288c9284a28d97b08abdf99f1763006a4afa143c2
-
Filesize
83KB
MD5cb77515b3d6047d50aa9c6ce0846ce37
SHA1a8dce70a6ec40707a946f0c6cb28ff38c442dec1
SHA25640aeb1d19fcbae9794b0fe1ed3f3f6acd79a7a383277300855930c4fdd73845d
SHA51239d4c09f5f03559e1f1cdeda152e4ad3ac85d42d3b0d17aab6832231aa906a4810925749066369c0b126ec6e782aba0e0deaf574edf4cf9b484223f3396deccd
-
Filesize
83KB
MD54929654177e45a5c3d0f555fd3256811
SHA1810f2a289860a8d86b02aa79d0b85efbfb8f2aaa
SHA256f4cb4bc0bf986da48cdddba2c27991bc66cfe18f19af34084e83643fb70e7838
SHA5123c6be7f6f5d3996b1b6a4d78127b5a56f4221541b1b72c5ad87719aa2252926d8dc2d1e534eff54c6e2a5acfda465841363c88ec095eeda395eaca3e9241399d
-
Filesize
83KB
MD54e3884d4ac0c5f9c40a569404e5a00ce
SHA1621fa0c6b2bf017473408318ae2dc05d5a33c7cc
SHA25696f2fb119333468db388a28731e0bfcda595e5807e09c7a5bde544ea9c82b836
SHA5125b9bb111c175178918a871e2834adadc25037a577dda8b940175ce6b395c2939224c9a267041be43c03bd3f44d750b9a4880b5f97ac8c6eb287f8b7780684724
-
Filesize
83KB
MD53309b04c3848b26e0840be587c2e3bc1
SHA1f9b46bdd3c694cadac6d6f9ab9a8962aadfbda8a
SHA25688555cbc769d1aa4e93ba9994f6258ec9c014eb134307e11e4849d727262263b
SHA5129c1b2b98700e10400c080b25da06d5d4a77d6149f20fb0dca34aaa0c5c4a3fa35e9118b6c3c366f2a7507337e78ccfd10cf8ec56d829e597ae99857b20474788
-
Filesize
83KB
MD53627dc94735d0c27d555d66a4d9a4edd
SHA165dac6f73ca08841af26850962462bb801aef9a9
SHA2563e84b86b9f834fbebc01f0933aa38a89fd55b7a6cfd9ac2386022585c7d92912
SHA5125a7fe0a80602930f89ec4c96b6d532de8af435758f3754c1a769484903790a8dab59d0e641ab44ba56f36eb8280567d73993769b8786d0e775e6051e12d3c4dc
-
Filesize
83KB
MD50c61ec769a3250792cd45b46721b353d
SHA182ccf4e9374fd86e500d3d5249a24d218c47b610
SHA256d58348d5b9c9079ecdedfad089b2d2eb9d522ff53e41becb4faa1ca7c3bbedff
SHA512eb696ae39c4c035e7edc03fd830e8732d40d6f3e8cf0631366221029bfb60864cec2b8dcb60aa160a46e2241da539181b46bd0f72a0b38a644ae2de43d09a1d7
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB