Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-11-2024 22:12
General
-
Target
64385216e60dcb6d309bcf4a0d2d23b00da5aa98d6161ef64a14064b8c3f84d8N.exe
-
Size
48KB
-
MD5
2822a0b54dcc87226dc2e4087f30f1c0
-
SHA1
a4763f701fe62f1824fb5884022186e65a55bc0a
-
SHA256
64385216e60dcb6d309bcf4a0d2d23b00da5aa98d6161ef64a14064b8c3f84d8
-
SHA512
06dec4e2c999b16766bf4bba055e210c685679a4a10f5d3ca3fb8f23ddae15a2a25db25d79aaef3218f2d0ee6be20b8260a84573fc2aefe27e5f1df85cf96f68
-
SSDEEP
768:qdhIN0XbRedKu1QeGTwK0NHXsH6bJCYhx8HV0kvcUwSuUCw3+MK:qdjQKpHTwKqWAxcpvcqu74+J
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\64385216e60dcb6d309bcf4a0d2d23b00da5aa98d6161ef64a14064b8c3f84d8N.exe"C:\Users\Admin\AppData\Local\Temp\64385216e60dcb6d309bcf4a0d2d23b00da5aa98d6161ef64a14064b8c3f84d8N.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD56c666b5a1b4baf945ce90891d6188b9e
SHA12eea4d009c80b347e2525efae7c03dce8d9b6d22
SHA256ba1b935fea2ddfe813395f2310c8fbe3977fd6f22984823318d30dc9a24913d9
SHA512f2fcaf1638d8657dd8f1368cb2ef7881421b72e70d2512227d8e73929b1789a283d98fce08f665058dc3a4d817a6f909510a78f0abf9167e5a98e597d8caec34
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB