Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-11-2024 20:29
General
-
Target
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe
-
Size
346KB
-
MD5
fb3976aa1f8c95f62ef0e1b1cf9a4db0
-
SHA1
98d8c6acfcba0229be3870ed481549007af90df5
-
SHA256
889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aa
-
SHA512
f9ff48aa1cdfd5a18281066555dc19a9e4629f82aa2ac626891596afa35a1eb7e6cf1b1d3fb18e08a554c7db3b42cc7cddde9bd78f51757e2d06e197af0e8c04
-
SSDEEP
6144:8uIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLqIYhuIlWqB6:X6Wq4aaE6KwyF5L0Y2D1PqLb6Wqo
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe"C:\Users\Admin\AppData\Local\Temp\889d3776978955b20091c642ccdfdee2843e0e9d08d4558bc08355d4469795aaN.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
346KB
MD534e13cedb215f10b0c994bcd3ccb77c2
SHA1a9fabd3db74036a955fc9dc9638e47901db44f01
SHA25699e38bfec3b9f049f0ea4406fc9b12444f765af747b3429d318b395b1e851478
SHA51288bfd334e9e95378dd0da4e03d710035d5a3fbf55c51b9129c6dd185cd458b9a9d38f98b1cc9b34b920277130732b1b45ff60dfe5813b1370092a8fe6033d98b
-
Filesize
82B
MD5c2d2dc50dca8a2bfdc8e2d59dfa5796d
SHA17a6150fc53244e28d1bcea437c0c9d276c41ccad
SHA256b2d38b3f122cfcf3cecabf0dfe2ab9c4182416d6961ae43f1eebee489cf3c960
SHA5126cfdd08729de9ee9d1f5d8fcd859144d32ddc0a9e7074202a7d03d3795bdf0027a074a6aa54f451d4166024c134b27c55c7142170e64d979d86c13801f937ce4
-
Filesize
346KB
MD546028de2671074b3f2b3fac0154eafcd
SHA1ff493d90036782970a72b189cfa785485f61be8f
SHA256c56877204be4aa0434e86834392dfc7e44c765c38f18790f4b434d6ca2d3944e
SHA5121cecef881e918a9e043107af82f3b052b02bc41e42204cd59bfaf34ac025246e85271903a6dde27a8373aecb0a5b9e1f0a441907c587a36b26bc4b2a1c4920a0
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB