Analysis
-
max time kernel
18s -
max time network
13s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-10-2024 15:06
General
-
Target
nl.exe
-
Size
9.9MB
-
MD5
fd4ceb3124de74d27b1e053b3a44dcca
-
SHA1
bc58663c46fa19005453b859bc8e4a44a0816243
-
SHA256
866f73e89b19292ef7f39485f9d093b4bbc21cb2d3292d62e278b6cb5fe7de11
-
SHA512
d07f7a1495eca9f1eac12f5c84e1d03e260a260a679c4b2ea777b6f4772a4227323f3df808e6350e63fa1941307b3fcb67de7def080b92c68df23507a581d2c4
-
SSDEEP
98304:DSqYOqIFdnwzdDhHPymsT9c3UsfFXHpE9BYvFZmFzy:2qYOdnwj6N9c3UsFXHqawzy
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of FindShellTrayWindow 40 IoCs
-
Suspicious use of SendNotifyMessage 40 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\nl.exe"C:\Users\Admin\AppData\Local\Temp\nl.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\nl.exe2⤵
- Views/modifies file attributes
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5fdd4f38bfc8d4a06d10ebb8866245453
SHA10bb57b532599686373bc053dd6ef632a74b1aaad
SHA2567f8e8c4655bfd93134b9b31ad14a0870e08e99effbff98288014fa6b25f00546
SHA512c7cbd47aede42a1227b97be212175402e7bdf4c03e302c8ce42b8afc4cd0fdc6f65f19b5b328145630f0adeda826991a746e8bd38770142b9e034a87695b20fe
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB