Analysis
-
max time kernel
144s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21-11-2024 07:39
General
-
Target
c2c4a34d1323b14554310d2f5a367970c120fb99d16be72513c6cc8a9225a8a9.exe
-
Size
90KB
-
MD5
ce4b012ab72e23e9b69455b5bc1e4e3b
-
SHA1
63b007c9da69ebdf3adc27d7a2508b43a13c7b7c
-
SHA256
c2c4a34d1323b14554310d2f5a367970c120fb99d16be72513c6cc8a9225a8a9
-
SHA512
1d687133de6d565a824242af61bf1350630bea65dd99ad9307d88f011fe11af59027ddc51985420ceb4cbef38c2d7ca32a4e85e85a824c491a59b636fd6aab31
-
SSDEEP
768:Qvw9816vhKQLroV4/wQRNrfrunMxVFA3b7glws:YEGh0oVl2unMxVS3Hgz
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c4a34d1323b14554310d2f5a367970c120fb99d16be72513c6cc8a9225a8a9.exe"C:\Users\Admin\AppData\Local\Temp\c2c4a34d1323b14554310d2f5a367970c120fb99d16be72513c6cc8a9225a8a9.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0735774D-1FF2-4563-AA36-B77C528EDF82}.exeC:\Windows\{0735774D-1FF2-4563-AA36-B77C528EDF82}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{86514099-BE25-4fba-8513-05099DB3B599}.exeC:\Windows\{86514099-BE25-4fba-8513-05099DB3B599}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20B9DF9D-1C66-449e-BBCE-A7C9054758ED}.exeC:\Windows\{20B9DF9D-1C66-449e-BBCE-A7C9054758ED}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A5F0910-D78E-49e7-B1CF-E015F9E3CC8B}.exeC:\Windows\{4A5F0910-D78E-49e7-B1CF-E015F9E3CC8B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07FF03C7-70B7-448d-8054-91695F3C862B}.exeC:\Windows\{07FF03C7-70B7-448d-8054-91695F3C862B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92FF6E5E-E09B-41d9-93B1-CF8154917706}.exeC:\Windows\{92FF6E5E-E09B-41d9-93B1-CF8154917706}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{394DE64A-6545-4418-92FB-7AF51F2C86EF}.exeC:\Windows\{394DE64A-6545-4418-92FB-7AF51F2C86EF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16F526F4-E4B1-405d-84AB-25F28A19B7ED}.exeC:\Windows\{16F526F4-E4B1-405d-84AB-25F28A19B7ED}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{91F726F4-D36B-4ca2-B7F7-F1555307FC02}.exeC:\Windows\{91F726F4-D36B-4ca2-B7F7-F1555307FC02}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{85CFCA57-95AF-497a-9A30-61FD3300774A}.exeC:\Windows\{85CFCA57-95AF-497a-9A30-61FD3300774A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{52D265CE-F52E-40c3-AF18-108BC02C914C}.exeC:\Windows\{52D265CE-F52E-40c3-AF18-108BC02C914C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85CFC~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91F72~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16F52~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{394DE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92FF6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07FF0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A5F0~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20B9D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{86514~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07357~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C2C4A3~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5fb55323364a91c4fca12026d3c4468d2
SHA1b3b6532de40c1a05526ce9ae1704690d1fb78951
SHA256c458f1ba36b8dde5986518bd761861c11c24a2606821f5bcd990a3599fecdc4a
SHA51290378293e10a8569cbcd4c784fdc01f9715e8aa8db8de679b56b904ebb8ff4100c26f3953aab6bad2f13b12a7d3c480f3e22d3b1b9880aef784e9552e568c1aa
-
Filesize
90KB
MD51929c53ad58fbc03a8616194ab0abb5f
SHA159c0e186c1b25ffd4659107b57edc062222d23a0
SHA25648fd65f6b93f2264599f60e694c941898c1d4381624d46411c043f3d877e0d1d
SHA512a6d17c365e6a86eaf892d885a808423c1f22b7c27c9f7dd26b1a0b05f55ebb58862588f19b2bf5dd9af17f103328b0d11e67c2f763d2f3c290a5ad207e9d68c7
-
Filesize
90KB
MD5e7044eb5d2aad8d70a4e10c002041bfb
SHA1526bac29512d0c5d1e11685295df3980b693a6d8
SHA25683fdd9b6d7e188cded1e1872b4cec97ac09e2433981fc0018f49536c40242e9a
SHA512b55bde0f3e018562edfe50d3da9ccdf3a2c40a30d166c3cd3462dac989759f9a4c98cfe7b6f80ad65debb9a0a619b6155a43a8f4c08102c226a008b9379f5dbe
-
Filesize
90KB
MD5955b3b96684a5fb4be538c0a69d11e53
SHA1287ccd15d4a68814bc844a596e7e348b78ce2da7
SHA2560b868f455c65ed2d8ca84039921db75d0181d267fe7edfbeef6249d8be3bd0d6
SHA5120cd65337317a49b9d61512649a7343f3f0ac7c398bbb04fb2be7775b10c415d6a7ec1063366d4f6b774970d57b7155b411e11d9bc2696659f1e7d8b38b55dfc2
-
Filesize
90KB
MD5dd9bd7d88e737607439dda3e8cbad40f
SHA16fe4378f96266ed07214b2f839125ef0f3c26115
SHA256a3bff3b344293f41e088577be8fc458ec5341868919a02f8612013d36132471d
SHA5129982a852b50717a737bf8430d1ad1d75f73c49f4ccad57b15ffdffb67438cd55aee278878d0c1b8269391eeb208153ecd746ef6b6353b3fbfd3a7fdd22039be1
-
Filesize
90KB
MD57a4b6c60c97cf8e2b3084f8b0fdc0d90
SHA1064741aea7af29a3fdb3e7c58276cfdd2f4199da
SHA256bb1c8969e0d6fc3e3cf6656d0e4d9f309a05f8553982537e1fde052e51142723
SHA51210de6a218934824d4a9398399af7ea2b4daa1139383d72e8e8bf2c79bd5bf12f8612d5f61d292318409b239d18c846f9963d5e22c6d0b7024b4e69530b775ce5
-
Filesize
90KB
MD560040e7a15da92b889bb334804a9cf9b
SHA1fee88c8edc56f12f6abf6dff9edba44da1703e92
SHA25617f0a492d0ecd8fd19240c7b7bd7de1ff4ab88c385cb65730f14d0ac893b031d
SHA51238014cd95bd56cbbf4e4302905b52c52b926d0c49c9773683b09dc8a9952e0a1d41c6b354d9060fb7a11f262015a7ff481a592267b3d5a2b0d8507d5562b8d26
-
Filesize
90KB
MD56ec5cce616978bd4806b7194ca819b2d
SHA16aa07cd35b1244b54bede21d9be5e6000ef4d577
SHA2560e7283327906aeaf16ca66781e3af706d8083ece3e388451d7fe3f210134a2d1
SHA512b773e9216d157c576505c1dd387b910e1f0d3669309408d00aa0caf33a20779e6a5e6e5ed131449f7618d06f3149a315732c84b0cf162fb7d7ee47d2813f28b3
-
Filesize
90KB
MD54f7301d7b41b93cb838071058eb69674
SHA1e7d0977fa740dec180cb6c3eff8a5370f9af18cc
SHA2568021c54f4ae726b947434b4535804816073a7640705fc4fb020f307b8823d61e
SHA512c57e44f15c4676132fac6550f325f01ddb82295ee91cf1e5a377f9bdea710b65d840437337c1a789278d0794c1daeca18cbdd64ac5407e345ba6e4a8d5b2e00b
-
Filesize
90KB
MD51e8794a2e6a2c26f63089afdfbfd2316
SHA15ad7dd40f8a2eb77f255f9491b1dc91b16f90ab8
SHA256685cb9c439e6fe73e345e124957d4ce04a1e309f9fe7a88f08f6c6d7c23acf97
SHA512d6cda3b1286ea308ae38ea25a48a6f02b3e5240617b4c358f41dc8abdfa8451c2d3603368eb6c9f261d367c82657c3e24a61e3a68a15e6c634113e1b3239d5ef
-
Filesize
90KB
MD533ee42ac52aac9d5f2b86056c965fe7b
SHA17943fab70fd5bfd932712d22a39fad77e8275473
SHA256b290e4d99e2857ff43ce03e3edaaea117061409c3d06ca29ee7f915280064040
SHA512ea15cfb05ffdd6bf67584aee6b6e586e084565af987dbf813940a4209d1d725b88954747d73ba71490685a874e60909459eab3127230c5c7f9e8eadec5ac48fd