Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
21-11-2024 09:16
General
-
Target
d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe
-
Size
88KB
-
MD5
a8aa99fec666e578a0961a3097cccc49
-
SHA1
352ecaaf9074d6cef69362991a1065fb9bb63011
-
SHA256
d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e
-
SHA512
d123299caeed70343ce091d0b26271d2d63701fb92f120f96d3f5b267a816b3a7f0fc844f9039e12bd0bf4612c6728fd9ecc49bc319926e0a434174c299674b3
-
SSDEEP
768:5vw9816thKQLroF4/wQkNrfrunMxVFA3V:lEG/0oFlbunMxVS3V
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe"C:\Users\Admin\AppData\Local\Temp\d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8521231F-7661-4ee0-8149-1427C719A524}.exeC:\Windows\{8521231F-7661-4ee0-8149-1427C719A524}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0C7FBC8-3B13-454a-B7C6-5BC7D60298EF}.exeC:\Windows\{C0C7FBC8-3B13-454a-B7C6-5BC7D60298EF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA016A1D-15D4-4b0b-9DF5-8585AA7BE8C3}.exeC:\Windows\{EA016A1D-15D4-4b0b-9DF5-8585AA7BE8C3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3509517-7823-4636-9464-E702902A5E50}.exeC:\Windows\{C3509517-7823-4636-9464-E702902A5E50}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8FEC164-8557-4e49-AC24-285AF5BCBF6E}.exeC:\Windows\{A8FEC164-8557-4e49-AC24-285AF5BCBF6E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB40DCEE-6973-4593-B227-9EEB3F32D51B}.exeC:\Windows\{FB40DCEE-6973-4593-B227-9EEB3F32D51B}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CA58BC7-F8AA-43a4-BF04-2593FAF516D8}.exeC:\Windows\{9CA58BC7-F8AA-43a4-BF04-2593FAF516D8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E3614F5-E4ED-43cf-BB43-3AA646A8CE11}.exeC:\Windows\{0E3614F5-E4ED-43cf-BB43-3AA646A8CE11}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{006E6770-4FC4-445f-BFA3-76EC55B8C6DF}.exeC:\Windows\{006E6770-4FC4-445f-BFA3-76EC55B8C6DF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{C8A93A07-3F7B-4a96-AAE4-E34EA3855174}.exeC:\Windows\{C8A93A07-3F7B-4a96-AAE4-E34EA3855174}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{43F76AB6-EB46-41b9-A54A-A2FEEF84584C}.exeC:\Windows\{43F76AB6-EB46-41b9-A54A-A2FEEF84584C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8A93~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{006E6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E361~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CA58~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB40D~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8FEC~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3509~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA016~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0C7F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85212~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D98CFA~1.EXE > nul2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD57067364ea62455983d9bd7a1c48a425b
SHA1675e9be5b8748e1481c08ba5c5247e46023fff54
SHA256fab6084642620282ebd26c321796fd7d6d89d6888e2c777089c0fe002ba9a51f
SHA51226019188fdb640f69a75fcbd3418a93aa6975ec9f9177643a2b7960af44b20081b4bb07844439fcbf08a42e23e4ecfd7138c9bfa1f3f8fdb66faf72672e6ebb8
-
Filesize
88KB
MD5ce5f60d184a5656f4dbea58d07f5a769
SHA1e4885a7cb33709680e414b1e9908259ea58f6e60
SHA256a89cd87aaf913d2a1f41584b285c43d78ae49fd64700f06ffbf65090562e7ef5
SHA51232ddce47d7ac81f5ed7859ae3f71ec0c7657e6b57cd2f957d284a92a064610c8f97c2c223124d128401c947b7b6541d4720a5142c29260c139e014f219d8492f
-
Filesize
88KB
MD5d45a1c2dcc363a44aa7cb25a86cb9ede
SHA15a5634954a5d93f7a00a23653779b9af410327f4
SHA2563cf249a129dab8bff203aa910763f6438e82ad0278c35d3943eaf08a07bb992e
SHA51270f7cfb12427a98da25f489f4fb91a80be1231f4cc166067867dd8e03dba8debad11f81bb6ba7ccffabba605b00cca938ba001362f14248ddab65b736d15cca7
-
Filesize
88KB
MD591b940e4cba6254a423aca5122c0e850
SHA1a9e19d86a9179801f4edf1768f63f43a9f85344b
SHA256581657603733dbdb99c37106989b94450d831c985507f47eac43f982d54ab7d0
SHA512f06433d6a2ccd7de7651aeb151f07c6e8d00774148df7c16d9855f474049364ab4dc3ed87400d62ef3feeeaca8023d203cddc9067c3e0c9b290a716de7b2925b
-
Filesize
88KB
MD5086ff5a530bfcff12dc993f5462167ae
SHA18c6c5f152996ee10ac45a05bf6ba825d9a881e6e
SHA25629ef586145ebd8a96528d4bd5fc4e5deacfb114fe21dad5d7dde683126c5b430
SHA512eac57f587c78e2d6d54b5d79a129ba79e4e67aeda9fcfe028b117a744bee71f2220f3cdaaca35b0316531cd4bdeb9b32c74b0d631e43529a510305fd0a80d0ce
-
Filesize
88KB
MD57dbe8b9ad5691f0852da6ec21864e0f1
SHA1e7266aa1fbabce4e4c43e56ccd42e8f93494196c
SHA25621c192f76b8f19757981979f9c22cfb472f88094bb7fb01f931ebbc1b2f5d966
SHA51282f25456ba6da6e15e671e414a8569d37c5f6c37823b75c3bfeec2d6faaf8cd51f850da7887cd0ee055188a150c91e26a99996cbc28232f1181fcd4c770fb032
-
Filesize
88KB
MD53518f8f2271fb8ba07275a4c65953b20
SHA1ffd25e97e1f781beca4eb7936eb6400ffcbd4294
SHA256506b47419d3a9bbd227662d9210ca4f065cb0cf6564ab7b1014acdc9419d0863
SHA512b2a19e9722eaa086cd61b180d60ae713dfba97451604316feef4bb7ba09811deac3d55bb63f0fa5f76b986c85e758b83976638dc078a8935fb82216b059ef57a
-
Filesize
88KB
MD51b467f5dd6e311e67042a3a5f20df681
SHA17cd639897d58518abe552e3cc657c961746aee91
SHA2566c69f363235ed8762cf31e96d3cd6fcbf8cef7c33b195dc02d269867f1685dc8
SHA512b6504d90b69417cf307b9d07f171d17f72afbf5751f3f8727ddcacafbd107440a146280562af10b1334b56592bda4923729835b712fa2702d363acc86f025525
-
Filesize
88KB
MD5781c6592913e6b2406a6306abde9deab
SHA1a4d059a30e7cac1e4fc94658e94184c0f71a47b7
SHA25623935ad36d236851026e24d017aa69dd96de36daeb48140ad9a437c0f0fed338
SHA512b91613d41777fade353d3723fedaad24bd6f6012e592bbfbb0e7ae0f3a2bbc725606b6841848c1b51a35e7bc31677f2c8033804e56972979a0d5b87a9b50f702
-
Filesize
88KB
MD55354f58efbbbccc9a025bd2a3bef9687
SHA1d6a8c47237ec394b94cece390938944107f80a27
SHA256f203bb7205e3fa1673c08d34e3d621e9b723fc0792620aef8522115f241b0e36
SHA5127967c9c32e8fe4d4f8be2c0bb91034843e7a2fa40e86e775aef0deaa451b83b3611a43a95eacf87c1fe838920966b08acc44cab56481f4d1cd8262fd85d0471d
-
Filesize
88KB
MD53890526677839a7f7e8cba96ee7eacc4
SHA17eb66244f6e28c8f50286d3b6c47687e19cda4d0
SHA2568fc5c99b022220a86c26a614875319572db3ea8dacff724ff4c9d710a8ed56fb
SHA512ef40187dbf6d10dafdd07b41c5281f15feb4b149a6e3d9b4ae536b7ee05ae034aea93947c190e5bf4b1b195f8a52167146c1327a79fe4e66cd8215339ad35ca2
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB