Analysis
-
max time kernel
74s -
max time network
64s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
-
submitted
08-12-2024 15:59
General
-
Target
net45.zip
-
Size
17.7MB
-
MD5
d433a1576c281261963e39ead71baf6a
-
SHA1
f5b5ceb009366f221635deffe24bfff4bba863b8
-
SHA256
23a2c144b274eacd5e0173cd4465bb0ca4d6382676ea3aa5e9408a4ba4f24321
-
SHA512
73012415f36294bf6e50f75108038039b820880d3d72077d401eae23776a4d8477eb234a1a23b233c0288788a8f4901502efe331079a680d191b84c804e95fcd
-
SSDEEP
393216:Q9FiQ33r3EbAeIo6rJTXYTVtpJ8vgMGOQxZ7OlIzqWaG2CPpHpg:QvNgbHGZclqgJOGq5Gpg
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\net45.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\net45\XWorm.exe"C:\Users\Admin\Desktop\net45\XWorm.exe"1⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3f4 0x2f01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
361KB
MD5e3143e8c70427a56dac73a808cba0c79
SHA163556c7ad9e778d5bd9092f834b5cc751e419d16
SHA256b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188
SHA51274e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc
-
Filesize
1.2MB
MD58ef41798df108ce9bd41382c9721b1c9
SHA11e6227635a12039f4d380531b032bf773f0e6de0
SHA256bc07ff22d4ee0b6fafcc12482ecf2981c172a672194c647cedf9b4d215ad9740
SHA5124c62af04d4a141b94eb3e1b0dbf3669cb53fe9b942072ed7bea6a848d87d8994cff5a5f639ab70f424eb79a4b7adabdde4da6d2f02f995bd8d55db23ce99f01b
-
Filesize
1.9MB
MD5bcc0fe2b28edd2da651388f84599059b
SHA144d7756708aafa08730ca9dbdc01091790940a4f
SHA256c6264665a882e73eb2262a74fea2c29b1921a9af33180126325fb67a851310ef
SHA5123bfc3d27c095dde988f779021d0479c8c1de80a404454813c6cae663e3fe63dc636bffa7de1094e18594c9d608fa7420a0651509544722f2a00288f0b7719cc8
-
Filesize
238KB
MD5ad3b4fae17bcabc254df49f5e76b87a6
SHA11683ff029eebaffdc7a4827827da7bb361c8747e
SHA256e3e5029bf5f29fa32d2f6cdda35697cd8e6035d5c78615f64d0b305d1bd926cf
SHA5123d6ecc9040b5079402229c214cb5f9354315131a630c43d1da95248edc1b97627fb9ba032d006380a67409619763fb91976295f8d22ca91894c88f38bb610cd3
-
Filesize
13.1MB
MD5e1324bb8e8608615a53666aa4814f76a
SHA15eb5ad414474c156720a0c96776d60d11591b68a
SHA2565b8de84b5f74453ebc5d898e6367009286bdf15f86ca36620242c48f41596bad
SHA512b79f58e355ca313c59e2470ed49838156be2a9918b1497728a1f63c4df1616fda4d11d66afe3a5ceaccc6a56ff8e63d544b0d0cb485f31dd2a37c0b270a86e04
-
Filesize
174B
MD5da07c2af754c1b46c1f46beb4a5cd5c9
SHA1fef14bd01149ed451d6e405af38369ce5c3ae187
SHA25660fda282bbc1aeb836b158dd6dde523e5225b365cc6fc0338dab9e82347b1e2d
SHA512f9ca0b8834b74aed39219d087f0f702a4f32be1554c6af3f2338dba9d793462ed638fdf0739b7809d8cd35593970eadff558b468093df7f5e536e8550ef88d6c
-
Filesize
8KB
-
Filesize
13.1MB
-
Filesize
2.0MB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB