Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 09:16
General
-
Target
d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe
-
Size
88KB
-
MD5
a8aa99fec666e578a0961a3097cccc49
-
SHA1
352ecaaf9074d6cef69362991a1065fb9bb63011
-
SHA256
d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e
-
SHA512
d123299caeed70343ce091d0b26271d2d63701fb92f120f96d3f5b267a816b3a7f0fc844f9039e12bd0bf4612c6728fd9ecc49bc319926e0a434174c299674b3
-
SSDEEP
768:5vw9816thKQLroF4/wQkNrfrunMxVFA3V:lEG/0oFlbunMxVS3V
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 24 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE 12 IoCs
-
Drops file in Windows directory 12 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe"C:\Users\Admin\AppData\Local\Temp\d98cfadd956da9584cf781b41a02295575cc9a8620d31404a54dd483792a5b4e.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B4EEEBE-5DE3-45ac-AFA8-F68852BDE8F2}.exeC:\Windows\{7B4EEEBE-5DE3-45ac-AFA8-F68852BDE8F2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1E0D130-6A2D-4d1e-A604-B58D71B8240A}.exeC:\Windows\{A1E0D130-6A2D-4d1e-A604-B58D71B8240A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BDDA735-1947-4517-86BA-08C8329CAFB5}.exeC:\Windows\{9BDDA735-1947-4517-86BA-08C8329CAFB5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83602AE3-5C6C-4fd1-9399-BA639972D34C}.exeC:\Windows\{83602AE3-5C6C-4fd1-9399-BA639972D34C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A781D72A-B790-49dc-BF2F-F62508527D8B}.exeC:\Windows\{A781D72A-B790-49dc-BF2F-F62508527D8B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A52F123-05D8-40da-8204-CC633EFBEF58}.exeC:\Windows\{3A52F123-05D8-40da-8204-CC633EFBEF58}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{418250CF-78D2-40f3-986F-7EC40BBF0D8A}.exeC:\Windows\{418250CF-78D2-40f3-986F-7EC40BBF0D8A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B48BC72C-E85D-4d84-83B4-082794ED1387}.exeC:\Windows\{B48BC72C-E85D-4d84-83B4-082794ED1387}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{07DCE21C-B11A-4988-9229-0BDECD6E7266}.exeC:\Windows\{07DCE21C-B11A-4988-9229-0BDECD6E7266}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{794861C5-00F9-4dcf-994F-D7ACC505C3B4}.exeC:\Windows\{794861C5-00F9-4dcf-994F-D7ACC505C3B4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42B266C4-25B1-4af1-B299-AEBB8B434E62}.exeC:\Windows\{42B266C4-25B1-4af1-B299-AEBB8B434E62}.exe12⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{39AA7CF0-CE33-4c59-8FBB-52EB0F050351}.exeC:\Windows\{39AA7CF0-CE33-4c59-8FBB-52EB0F050351}.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42B26~1.EXE > nul13⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79486~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{07DCE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B48BC~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41825~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A52F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A781D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83602~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BDDA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1E0D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B4EE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\D98CFA~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5282d6ec20980c2e22acc7653d15f7366
SHA1159f809dcf8eb9bc03d1586ab1a571b08e160e91
SHA2561ebaa5d226176b02ed35e43356acaef23bc945e3812c061969c07ddc7e5b55a4
SHA5129f1d804d6e46c838e5a6d007f8e05d9ccc45321bd23fa97eb97c4fd02fc8f83437feec66d901737a939819f4611b9a1b2913f42cc2781082840a9e9cbeb69a1a
-
Filesize
88KB
MD5462f7b5b425051dbda8d1d44eebf50a0
SHA10e783f46ff93df3746138346b189236d8fa795a4
SHA2562473539b5f45b12cbf5e2d463784505731fc78a91e0fed782c7d2f899deaac02
SHA51277d0e122fef21a92bfd7a8ee259e5ab2351e52e2996d754829cf2f8fc913a7e9c90016a8109918d902905f009f2ce1ace4e375654aa2213288ba359aaebcdf67
-
Filesize
88KB
MD5c107c4c3324f8bdf1f9edad7e0e3c3ac
SHA1e3750b361b432707b4b9caa9a54e05a05285366d
SHA256f5abcebe4f9ebaa5ed06832f16a221058771e3609e3de499e31fa175c1f21cb3
SHA512be3fa3bea7ca4d6aa22a37c440ea7be142c11c23b2ee13ef04d7654697193cba28c55b8e7a06dd46299dccbbacf6a618e631cdae57dcd83e1e4987bc85bb6a16
-
Filesize
88KB
MD533703af6a71c4620297c294f1f091213
SHA16a5215d640ed22381280010830ec2464cc35c694
SHA256ee79245d9366338af23525f7eb5b72a13f2ed013080dd6dfb2545e4d5348846c
SHA512f21db49a27fa786a4509fd23290f968f02870e62be5f0260352fcdabb9a12bb31591fd87adb2ccab1013b8a1371273c064955c642dad8e0f3e4d3790d880d29d
-
Filesize
88KB
MD537a03183795636c163ee273135ddec2f
SHA1a30c53aa1cc7de93685a8a7d394457ed2db089f0
SHA256f429dd55f15580685504ed03a83abfbadac0364e906b2ba9108fdd89ff0ebf7e
SHA5127311ac5e9a1f732e4131f34fe499728a39ef5b17caaad2c40f47281848cf1779bc4011624b535c9e1ca2ebdb482ad841bd63e8b8d10e28a83875ea7f844ff577
-
Filesize
88KB
MD5667aa2e0d208aa35798a0444a6bd9461
SHA1b4b4fd5b415d30766042f1a4f0ce8d00bd7829a7
SHA256e1381d125cec2181e02cbc57402e0a7a9a408df3671411968902ade9719b5e90
SHA51268c448cec4b9cf1e88204cc148ac4b45d0c525847eb55575a5d0b19bae2f7a1afee4bd2499ace8b9c5abd2048d5105e4c0aaeb91e23be9d8b4948b057ea32a2e
-
Filesize
88KB
MD529cdd5ba056ba40ac0b036f459206202
SHA17e7cf60865e74f3588f5c38a70cf22951b000205
SHA2565ddc3f28d1cabee35bfd42ea4495fc09396e0fdb42b575678e9ff7fe1a813adb
SHA512b85e18f5ec6bd25b1d7d3c57f8e165427c7658dcb5e86b63f43012c52bff3d8db3f33e555639a81d212e2b1c455a180289afd76fa71103789f16c1122c533f6f
-
Filesize
88KB
MD5425443d79fa8432d21e756b93ca96ad2
SHA1a9c559dfe34ec786779764bf52e50bd569fe61d4
SHA256f4e12cee7838c9bcbf79956c851498d6cf2c518666ee890b6d5e20e8d443b127
SHA51226b9317476887856248f814064a49b8b84c4368819a7f9fd13737710b5fa82310ad2cfd0db4e642db2c1b67cf68d57d4c83e283b6130e0b2b36e5b173675ba7d
-
Filesize
88KB
MD530fb9d7ab5af13bd95a545fb45d679e1
SHA1fcd551609c1f9ca1202c8bb94242fd95b11a1831
SHA256757b4a8a65e66f280ad3aaed7e4a454954a5b1b24073ea649af5005606657073
SHA5127aeda3d2bf1bb2286af955bfad1ade8bc8f000445ecbee7cdc2014962ae9a943b0918c661d454006b98c96b0f643e360f3ec63dc1a12191d7afeacf16d4aa204
-
Filesize
88KB
MD55e77e0925d413d0e4fd1fc92911b7ce6
SHA10c86ecc019e4cea47512e69ece579c5d8f2695b8
SHA25658f1c402d0c0dbafee12b7b1c30bb8382a40ea1721962ff1663d1b6182e23f08
SHA51286c633aef40d728c59d6ba379c0b1f9c7ebfab9c783961a419dfe2c2b3566b0025fe0a07f4a8fe596be6b2454bdabd14a4511df76727a8961273ec4d5f240443
-
Filesize
88KB
MD53787e31b85948cce012c2ed0df45df37
SHA1638c8dccc9c3b26f3eb2ac84fc8169e28f3bf1d4
SHA2560a3860952a14eeae13629577b8e7a88bbe7a3d95a1d1076d1ecec92ab34e617a
SHA512126230b85cb2f6b9dbc79bf607043d986c3a35c58b99aca8692ffb94c502aa84a39d0c2ac83b0b108d4556b3426d2d6b10477fc94829867b923e9d81b9f16f5f
-
Filesize
88KB
MD55b569543e5f3cbe4b46b280ee10ed31a
SHA1acc49ee908c56cfe566c300ff63f21b1199542bc
SHA2564792df8b61eaa127ff8d3a2fb2b07da0944d921138215994a080385af6ec9ef9
SHA51252c53a81e898981cac0b6f9517858b3dce16c69bae561479da1d79535212fa7fbf3e8331f5259d3513ecf6e9974acdaba1b86625760bdd8b0b9cbbf6d8bd09d3
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB