Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09/10/2024, 00:37
General
-
Target
8d1c7cab2db6656b5cb133cdeb0e32ee68aa5ccfb8b223d5f6d27b6610496e2e.exe
-
Size
83KB
-
MD5
afca40013a773e297cf4968dc79d7f0e
-
SHA1
a2ae32f6394831b3f14c3eea8c85a5f0ced25f73
-
SHA256
8d1c7cab2db6656b5cb133cdeb0e32ee68aa5ccfb8b223d5f6d27b6610496e2e
-
SHA512
339cc0c4d846a44f1c6e1e81efc9677abeb85bdf8f0cc3469e93afa2346af2cd745f19ad1a79e61bee37e2b866006ed3fc35faf14bcd66698145c05483d7228f
-
SSDEEP
1536:q4Gh0o4c0p3nouy8QbunMxVS3HgdoKjhLJh731xvsr:q4Gh0o4c05outQCMUyNjhLJh731xvsr
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
UPX packed file 49 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d1c7cab2db6656b5cb133cdeb0e32ee68aa5ccfb8b223d5f6d27b6610496e2e.exe"C:\Users\Admin\AppData\Local\Temp\8d1c7cab2db6656b5cb133cdeb0e32ee68aa5ccfb8b223d5f6d27b6610496e2e.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E98AB76E-68B1-403c-922D-16991718A1AB}.exeC:\Windows\{E98AB76E-68B1-403c-922D-16991718A1AB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18C7B304-F2F9-4633-B654-2F6114F86D08}.exeC:\Windows\{18C7B304-F2F9-4633-B654-2F6114F86D08}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E17CA5F-25FB-4220-A08D-29BE73D496F9}.exeC:\Windows\{2E17CA5F-25FB-4220-A08D-29BE73D496F9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CE34200-80FE-4ac7-86D5-258ECA8858E4}.exeC:\Windows\{2CE34200-80FE-4ac7-86D5-258ECA8858E4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8AB4CA1-D426-40f5-A1CE-C5FB265566E3}.exeC:\Windows\{A8AB4CA1-D426-40f5-A1CE-C5FB265566E3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72921A9A-DF5C-4c8f-B14D-0F9C092D322B}.exeC:\Windows\{72921A9A-DF5C-4c8f-B14D-0F9C092D322B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0854D9E9-E33A-4d54-939D-A721EE6A8F7F}.exeC:\Windows\{0854D9E9-E33A-4d54-939D-A721EE6A8F7F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3187DAD-FD43-496a-8BE2-7249C3E1FE76}.exeC:\Windows\{C3187DAD-FD43-496a-8BE2-7249C3E1FE76}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEDDE75A-BFF9-48c4-B5F9-7BB56684D5BC}.exeC:\Windows\{BEDDE75A-BFF9-48c4-B5F9-7BB56684D5BC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{834546A1-BAA5-47b2-A5DA-58A0E184A9BE}.exeC:\Windows\{834546A1-BAA5-47b2-A5DA-58A0E184A9BE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A994142-8C6F-456e-AFE3-520864489AB8}.exeC:\Windows\{4A994142-8C6F-456e-AFE3-520864489AB8}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{D726C50F-9041-44dc-953C-18AF589FAF1D}.exeC:\Windows\{D726C50F-9041-44dc-953C-18AF589FAF1D}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A994~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83454~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEDDE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3187~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0854D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72921~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8AB4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CE34~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E17C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18C7B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E98AB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\8D1C7C~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD52c5c9ec1a7882fc72dce42bfc43ddfaf
SHA110176c97036a9212b17624ca447ec294bf6a860f
SHA2566f93bb1e9e53a7004e4557ae336a211af54ac68f2afbd07d98ca9f32012251b8
SHA512f1b32a1720eaec8ad0fd3fe5e23c3fbf0a77078ca064b6240eb338a6dd05bb588ce58d031665d1ae5405ee286799d5bbf0b7ee3f7497e39232a3b810603f8f4e
-
Filesize
83KB
MD593b5e40cd13928d0f96e43bd1516dd4d
SHA109591d78d8933fe6d282ac34292d6381bd463db5
SHA2569ccb5c8408b0d1fd60696a649244c9c456767ebba7016f84d49eb195ab34631a
SHA5126ca958c5bfcb0cfc912d682fd05cd79c69fc9f91cf8312a78232d3cf97326836d78c800e28124d3e54497ba4b8cdb87eb64bf31d9422a827ac171758218cab40
-
Filesize
83KB
MD5d246d19c71d9a7976d8826b944b6dbaf
SHA1beadd342a456f17791ed1ebccab3ffd057437113
SHA256f871223e224613c9a721f10a2a5f33f7f948ea547778e7d2c1d9dc1e27d43f72
SHA5120227c777896a29f1ad1820fa99696b9f7affd449f20da1ce8d38d76ed350e4af53280db761cc5d1c9feb867ef4a6cdc881fc1abe90ec0e96db0de7eb6dc42359
-
Filesize
83KB
MD5db5ab693f3d7c2c7f15879071dea0f97
SHA1dcbb0fc26fd68e43892078f1dd23b745abd73469
SHA256c9b9303af8dcd54262b104ff008104f9cbcbf5c13bcc72503ba78d41b01ca782
SHA51259d0beab2220037c61d3527d50e86843ad48a8419522c0d37f859f285387b604faea53a4cee5bd0ce14c5f0e7a3209e52b0af453db875fd6ed3b12a0efb42ec4
-
Filesize
83KB
MD543df849b6e41ec4a3269a08f1f1063d7
SHA183796006a4e7bc4ed28946d52e7df3532fe456d1
SHA25624c2f8883eed93b769c41ca46c82e8d5f4e1d2e6a879f6fcc05f935c17a3fbb6
SHA5122e80903c9ebefb10db6ab052e340bd48bf4ae92668794adbe58252785e061398e8291c6c771bf6fcbf07b2e8907a47fb8181e14b3a83681b67274d41db7e3f36
-
Filesize
83KB
MD5d9d514de8858e4a021d9d831eddd0b6f
SHA167f38938df894302bca23f7fe938ff5ad75de2a1
SHA2561458cf82f66d0b5b6f35b6300bfe6224c79c203f75e39ede18abbd5e64f00b88
SHA51217bb8768eed7884bb913862686214d7dcbee4829a3dc8ddd34e2f82f20f28ce61c378d931144a8cf50d6dc8c866c4c8cee3944f9cc371a40e61dd5308c000111
-
Filesize
83KB
MD53bad82d3066826601f4086845b0302ff
SHA1d76fe90b1d7e06f5be777383a9fbe8eaf206d5c2
SHA2562bfcd1d0906e471deeadb52882659a83b371dfcd51cfc3f2f986e538c471acb9
SHA512f8524c4df510ca1853037d0a8d1a08e83810432f631e53733afa5d999a74116513e59aa672bae17e8d3388e48b37ef975fac335d233e6d98283314e8b7145828
-
Filesize
83KB
MD5426ad4b5384039e4b9c723bcacb41377
SHA168fdacfe4cdae0320eba6d058bfe274e52b15b32
SHA2567c2dc93653b763c89dd4822c3ce0fa580a13fe4445e376107d8437be96db3f60
SHA51218b89b242769e2d505c042acfe743f12cbd1365467e11aaf6a67d763dd63bf6f286ef4434476992c5193f4455deca16c994c458f4385d0fd8b90d4b56c1948d3
-
Filesize
83KB
MD5df208f78e5bbeb4e09e4b31442a1b4a3
SHA1e7c6d9f273036de2c892faa5e9cf5f619cd32319
SHA256de13d357ef00f67b0c66535d22af22a9ef327952ca0e4c99efde0d62d29c9a86
SHA51242c8fc2f525e8aee28092fcd419b92e18dbbe157c37c0673fc3b84963a269b5dd9b44fb77e7b0247fdc6e15c1af9fc22e0add99547aa35c39b8e950ab0504158
-
Filesize
83KB
MD52a5a9e72636ebc6ce11dc7e30e4421ad
SHA1d3171187053b371e594450cb129e8b982aac843b
SHA256616743f26a0ba6a6efc3fc278d917040ae3752466f5f0fbc5ac26cf3c874f6a1
SHA512c989141d272e09af5cb487ce06c9bb46f67a3b922481d07b285197d63455efbfc28874ebb11ac07495c2eb044a5e2a86e1de197c4288b1be8bde69a92b0e0b95
-
Filesize
83KB
MD59c3a4550de97441a54d80b83891917d6
SHA1f44afc686feb617332d1745eefed3a0ff926fbd7
SHA256be50d8054a1a5b8fcb3747ec7a8dd3681b461134b07d3b7fed15cd0cd22ccdda
SHA512c957f1f2271ea1a99bbf6f5b1897722631dbec6ce3cd51b0e734e2dcb772b910c7d78e30e4c7026401f9d7e2a32311c955dbf22544e4105bb98f07cac4357b8a
-
Filesize
83KB
MD544aac25a2353bf81cc7b8c81c31729da
SHA150ffef16e750e1b7851be52ffde6f807523835c2
SHA256017f41059b9b0c35df2d149c1084b66b7e69d83387fb747d977234852cc5f29a
SHA512f0c8f58edab85eb2db1d5b5737c5eecb5b2d2132097fd453441446144dc4a0ea06810f4a3794016d48e75558e7d03936731e0c66f1e729ed4632963c22d52ba9
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
76KB