Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 07:44
General
-
Target
c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.exe
-
Size
3.4MB
-
MD5
58b1c0ccc6fefbe5bef084c22242c02a
-
SHA1
7d893a7f4f67f34240f34e167451a01111a4893f
-
SHA256
c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf
-
SHA512
e99fd367b510e56d677499132749b5e469b27d09d09c72e7bb5df89301174d260e447703a990c1fd28fa6284942744d741e679592c6f1f2d8617a20686bcfbe6
-
SSDEEP
49152:tiCrJIy7pa576ffEa2FccgWOF9TQm7an/e1RpxL3/rxcHhwi8qgC71/i0inVm0:tiTy7pat6ggA/e1/xL3/r+Si8q7xiTVn
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 21 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 19 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.exe"C:\Users\Admin\AppData\Local\Temp\c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FF0SD.tmp\c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.tmp"C:\Users\Admin\AppData\Local\Temp\is-FF0SD.tmp\c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.tmp" /SL5="$A0048,2764328,770048,C:\Users\Admin\AppData\Local\Temp\c1c1103f8868a96f59f1234be24ef3ae0c577b0d28dd48ca7fbde74986293bdf.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\nh\Epstein-Barr virus C10, W1, M4 gene methylation and human RASSF1A, WIF1 gene methylation combined detection analysis software\NPClear Analysis Software.exe"C:\Program Files (x86)\nh\Epstein-Barr virus C10, W1, M4 gene methylation and human RASSF1A, WIF1 gene methylation combined detection analysis software\NPClear Analysis Software.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD532ab913953533b02d7cec58d3821b887
SHA1e1a509864e6762c2e4ca3a6440ec5a5030dfb0b0
SHA2565ef45c318406c7c2ba346b72ca2d2af2980e678acf4ea817ba823868b4c6c834
SHA512aa7a223d598004ddf578f45fabcc89439c005273ce16b6d078fff045f10281bc911bb30754178d1dc137c662a950d16255e266a0f14f5baf05bbe23592af4be4
-
Filesize
124KB
MD5de1b29546192e52a61711c9e7c7d76d9
SHA14b51358de58e4335ae77f990e1ef9816699856f3
SHA2566735dc70bc4988b977ad5df5d8f785c34a786324729a3ac48a9cd96ba5c69471
SHA512f3c2d912b526c0b534fc2fa7ffd05fb3266c89148953ba9c85eaaf21cc3746db54328e90e306062aa2f439f9c034389e01d7c86c588717768e8fdc74dd2f765d
-
Filesize
12KB
MD5f74af58cbc5f9adba649974bbaa9c2a1
SHA131ec0a88b11cc8ea6d243064e9ba429a9e7d5ed2
SHA256319437f1ab7576df30ed5252df3c53c08d1539540f9263b3baed9116fa9e32ef
SHA512babbc2e4d52bf01f09d2606c351706c5da964e843fdbfe9478def24c9d77b7c1074f57adddd32872d30b8c9ce67ffa3069e6402a048628f2b21e861316c01499
-
Filesize
3.0MB
MD568a2097a5d9611f54423d5d8ee728c05
SHA1cccb3d5d7f270993fd8d9e20a1e789d1e7c1d02f
SHA25673957f3b7432928dadc0c0fd50fac94e9b8fc992c03640e49593bff5e485495f
SHA512432f56dd236ba62d5d9ad1175c9a30a32774fa0f8b0af11230bfd95b90f3ac42746487b35b0e1255e1ed511a17e6f62776de00398c7056f9ed369cffb9b7aede
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
668KB
-
Filesize
804KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
3.1MB