Resubmissions
09/03/2025, 15:14
250309-smnybatny9 1009/03/2025, 15:12
250309-slbllatwfw 1004/08/2020, 08:43
200804-zht2wvvd9x 8Analysis
-
max time kernel
149s -
max time network
38s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
04/08/2020, 08:43
General
-
Target
PO2008042236.exe
-
Size
3.3MB
-
MD5
e8ac867e5f51bdcf5ab7b06a8bced131
-
SHA1
2ef0bcf55f35494572ef21556660e41be31d0eec
-
SHA256
a66d1021e54269963e9a54892869d569ffa1c74d9fb1b67f023ea5fdfd90c1a6
-
SHA512
3816fe7a1ef541ccbb2f0d436b53af2b122dbb28eebd1f220ac77be3526be605f6ae46f19200459de45b2245e044bcd534fdf9ae4a160ad3dff0f2ab74e8d86e
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO2008042236.exe"C:\Users\Admin\AppData\Local\Temp\PO2008042236.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\dfzkdn\CefRender.exe"C:\Users\Public\Documents\dfzkdn\CefRender.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Checks processor information in registry
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
4KB