Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 03:39
General
-
Target
screenshot2016.exe
-
Size
4.6MB
-
MD5
b8c469c681323bad2efac3b30897e18f
-
SHA1
56bae6961b1fc0e3415b57483c1c21b8eaebd4b8
-
SHA256
121dd64aa3a17da1a9d27ae4ac84538a3b8ec23abec2f5f6e69a06f7826c4df5
-
SHA512
7184f92a537ea0737933190291bf49f64ecdba62739f2ea3546bb90f4868b08b48711eadbfd4c3d4166785abf1d759808d399c73cdf0cc2929a422ed6ff32f15
-
SSDEEP
49152:kvLL7UyvZBZF6DFrpnC6DFrpn67n7Z/1cvLL7UyVZbvLL7UygvLL7UyHvLL7Uy1l:krUy3KNpnCKNpnjrUybrUygrUyHrUy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\screenshot2016.exe"C:\Users\Admin\AppData\Local\Temp\screenshot2016.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CaptureItPlus.exe"C:\Users\Admin\AppData\Local\Temp\CaptureItPlus.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
410KB
MD5e8cc55a833bfd86a6d3c4ad8391050cb
SHA1dee0d797b0ccf1cd6c47b6c9fa9f157ccf3e4c62
SHA25624b6c0f724c496aefab3e6a58b194213dc4ca4016e50ce8428b4fe15c6b6b240
SHA5129c0639a3efaefd2a0c3dbc2ead4f1314290ac4506997f8026a62be0f641c79509201198bab7bd0496f19875b8571c6fd519520e0b0b4d673ef0121156178fca3
-
Filesize
432KB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4.6MB
-
Filesize
304KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB