Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 08:10
General
-
Target
9e7b9cec2792e7e3efd7ae08328a64a79427d4be79210d1529fd146a2dc76f96.exe
-
Size
76KB
-
MD5
74f4d3c1b88440eb332154535d6ddbd6
-
SHA1
5a840497bbf0809d158a9937f5de1c9bf8bca4b0
-
SHA256
9e7b9cec2792e7e3efd7ae08328a64a79427d4be79210d1529fd146a2dc76f96
-
SHA512
38d45ce90bfdd9c7bb86e4d5e89760a23b3a628c528855b7925b4fd3ff5adbc7c0220a9134d54dea37d1865e9d28c89a9ae68c3b33618a4e32dd4026083905e3
-
SSDEEP
768:agO5xRYi+SfSWHHNvvG5bnl/NqNwsKVDstHxYD0p1aXKynF0vQmYZS0HdJnfWO04:RshfSWHHNvoLqNwDDGw02eQmh0HjWO04
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Modifies system executable filetype association 2 TTPs 5 IoCs
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 15 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e7b9cec2792e7e3efd7ae08328a64a79427d4be79210d1529fd146a2dc76f96.exe"C:\Users\Admin\AppData\Local\Temp\9e7b9cec2792e7e3efd7ae08328a64a79427d4be79210d1529fd146a2dc76f96.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD52158f90e2bffe165fa9638caf0a3715a
SHA11cf3a3d602bf469868dd8db48596ec49ea30f50b
SHA256779261370557b36b91b78c3ba95737fd00acdce010344300cb91a3860a041f80
SHA512099ece7b064e4cb78a427593dc99dcfa2140209c84b955cb08bf057360739fb550b55d61d583a494df6027aa028be9ffda44eddd38640ebdeeff3b5393ab13a3
-
Filesize
82KB
MD5655699eb456375dc91b592a57944c9ed
SHA1252f5b741b3921aab76323419e6d7e4b78a10e1d
SHA256ea92fb990f527a20d1490c046cffbfb7c82a9b5ddefeb89d64b62c645c947128
SHA512df64396487f37ebd882ef7446ec71e02878393c370b3b7fe06c646342dcc52ce517749db4bc707d94071bc324cc756ff8a33c3c4cbc92877456a37b6d3dd4ce3
-
Filesize
86KB
-
Filesize
86KB
-
Filesize
86KB