Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
02-10-2024 01:34
General
-
Target
a35a2648e9c5f0c24e5f2ce724b3b7b4293f61e1a315fe5c912f19cf601bf007N.exe
-
Size
1.3MB
-
MD5
41f3ee5162029ac17694806cf4e29940
-
SHA1
97e378b0b451ede65063fb336da8f550b583ce8a
-
SHA256
a35a2648e9c5f0c24e5f2ce724b3b7b4293f61e1a315fe5c912f19cf601bf007
-
SHA512
789996c65d5bf707eb9142de7b88803198705b6b9561770a314450b598f333e0821abd7683426752c12d65fa019ae294f4d971911c9215c9fccc096240ebb5cc
-
SSDEEP
24576:9SZ+J3rtih2XY/vK2Rk4stL2KEdAlzOev0X9bgr4xXWS:eKrsh2r2VstL2vdAVOevyxXWS
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 29 IoCs
-
Drops file in Windows directory 4 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a35a2648e9c5f0c24e5f2ce724b3b7b4293f61e1a315fe5c912f19cf601bf007N.exe"C:\Users\Admin\AppData\Local\Temp\a35a2648e9c5f0c24e5f2ce724b3b7b4293f61e1a315fe5c912f19cf601bf007N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5158e1c156c99bd14598e66b6ce075512
SHA115e5a41f61bdc610ef1d0184c0bc45558708d5a6
SHA2562d6616c73178151f0a5016ffb1e2ca868fa17b61ff6fa37260d34530dbbbb1da
SHA512c26875083c38142b418b424cc2f39e818871721b665438bd137e1da612b4c7bb7525fe46e9348237a8dfe35c993613f9aee09bd78fd9ddacb312915c770782a2
-
Filesize
1.3MB
MD55670148d7e5ddd6f2d3d7c7854fb479a
SHA1608e163cf21b773333730bb6c7f47cd84d01bafe
SHA25621972e17f2da96f0dec65eb3ab777cd553bdc345990370c2b9fb77efe6e5f7db
SHA512f09dd85b5fd459bbbf9372acb89073a8d9b0337db250f67d6a2316c54a77b0190dfadfa87ecca9074384d2e2fa17a610061ecdd41a9b79d5d2f204c808f0d0b6
-
Filesize
1.3MB
MD586353a3cce0559a91d60692ee84f855b
SHA162c44a669c7c73808a78ef9bc491f3f7c85f6a8f
SHA2561164de7c4ea5a32275257fbe271d822805048b7bc918212fafe89d88ceb29457
SHA512305cfbf0b22a99c55035d467be6fbf66ba68939e8f8ef8514a8f83e363549ca2f3203730435385b9cc41228814c1d0362a8bcd7542d09013bedc8fda40a0aa66
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
3.7MB