Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
22/11/2024, 14:07
General
-
Target
f9e3fc85d1dc4ccd69fe85d125cc6269af8fc86a877f27484525d368c15f97aa.exe
-
Size
48KB
-
MD5
c1d3d2bb476dbe351c4f99578a0d4769
-
SHA1
4b083a6fa91ea465b244f396d8fe5f2a65a8aae1
-
SHA256
f9e3fc85d1dc4ccd69fe85d125cc6269af8fc86a877f27484525d368c15f97aa
-
SHA512
2390fa1c35baddf69a572c538a49aad994d1770172b8544ad07724b7581a2ad986925491296f69457d4908850589f46961788bcc7fdf65a1897cc4f7f9c796d9
-
SSDEEP
768:qdhIN0XbRedKu1QeGTwK0NHXsH6bJCYhx8HV0kvcUwSuUCw3+MKh:qdjQKpHTwKqWAxcpvcqu74+Jh
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9e3fc85d1dc4ccd69fe85d125cc6269af8fc86a877f27484525d368c15f97aa.exe"C:\Users\Admin\AppData\Local\Temp\f9e3fc85d1dc4ccd69fe85d125cc6269af8fc86a877f27484525d368c15f97aa.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Admin.exe"C:\Users\Admin\Admin.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5ab6c286acc122b4415273eca7750a2e4
SHA1c86fa33529ce5edb51ffabc1be01aa282ab9adea
SHA256fbf1accb56a8e24ad3122a0fb29a5dff8b5d0aa57d7b3e1a7100a45106223789
SHA512f595dfd98cfa0b1b5572f3baf564b295e580b5cc73fa3bd7c6d6d4fe9124b2517957f46ee8461bbb0371d21d9219767c202131d775f8cdc685efdffc2bc0625f
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB