Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
20-11-2024 19:40
General
-
Target
55c93487c7931738b38e461a11f89185c963013204da728625b52520a31eeedcN.exe
-
Size
48KB
-
MD5
536e09e9ec1386fb8692f426eb8391e0
-
SHA1
c03e1e9c59466e159810512f9c50b389814bf2a4
-
SHA256
55c93487c7931738b38e461a11f89185c963013204da728625b52520a31eeedc
-
SHA512
3bf719bf97dd5f7cdae265afc0df622f3f03e9e6499488e460682f2bb33e74b63d67cc6d47fbc9f67ee7369733dc151eba6cd3e83c35b037f1de4cf0fd82a2f5
-
SSDEEP
768:qrQN0XnVvbrWQeGTwK0NHXsH6bJCYhx8HV0kvcUwSuUCw3+MK:qrtv5HTwKqWAxcpvcqu74+J
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55c93487c7931738b38e461a11f89185c963013204da728625b52520a31eeedcN.exe"C:\Users\Admin\AppData\Local\Temp\55c93487c7931738b38e461a11f89185c963013204da728625b52520a31eeedcN.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD56c6a836563865140675cc35584b4638f
SHA120d947421f351598c289c5c91f331dd7641cd55d
SHA256a136251a35a2c0126b4288135fab797dd718578715ef26afcbec2a1ce2374792
SHA512e9fd0e4344173312f2d8974a01e52c20cf6b12a27276ba056e6c5fd38965b71c4e40ff26005859914735e88fc2427ad77c51ad5d4d1d8dc413c1ec38e28f02e5
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB