Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
-
submitted
12-01-2025 01:06
General
-
Target
idk.exe
-
Size
839KB
-
MD5
bddc58491603cfa73dfba7979034f776
-
SHA1
ca7a5dab243f239aa6f821c36502ba09c1a260f3
-
SHA256
40c4a1db022d73b058eac101c95cb86a60bc7379e5d2f8371e0e4bdba71404a5
-
SHA512
1eaebb8b342650acb9fb7e7a572bd99405213db703bb41d23188a68f4c743669c3cd0668cee10074c37c7b4b6a4a65b7089dddcb3890917c7d0e99ec39d029b2
-
SSDEEP
24576:qpS04YNEMuExDiU6E5R9s8xY/2l/dmtnIbt+rO:qL4auS+UjfU2TmdIbt+r
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 45 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\idk.exe"C:\Users\Admin\AppData\Local\Temp\idk.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Speech\AudioDriver.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
839KB
MD5bddc58491603cfa73dfba7979034f776
SHA1ca7a5dab243f239aa6f821c36502ba09c1a260f3
SHA25640c4a1db022d73b058eac101c95cb86a60bc7379e5d2f8371e0e4bdba71404a5
SHA5121eaebb8b342650acb9fb7e7a572bd99405213db703bb41d23188a68f4c743669c3cd0668cee10074c37c7b4b6a4a65b7089dddcb3890917c7d0e99ec39d029b2
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB