Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
21-09-2022 16:19
Behavioral task
behavioral1
Sample
Policy Update/Policy.pdf
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Policy Update/Policy.pdf
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Policy Update/Policy.pdf.lnk
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
Policy Update/Policy.pdf.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Policy Update/policy.exe
Resource
win7-20220812-en
General
-
Target
Policy Update/policy.exe
-
Size
251.0MB
-
MD5
a5e000f19e9c29c93a6031ff7d47d810
-
SHA1
f4ba54b3237e097f79775e215591d56981ce911c
-
SHA256
01bd1272adb7e8855c7aa3a40cc3cb5606b07219fdcf9a91ee90aee9569cf6fe
-
SHA512
24f6a82cf2cf3ad9ea55211144f79d60bf93c5b22b768b96ca513f6aef36cc5588686d476a812eec0351b840be47cb8b95125311304259e05256d26f4153cce2
-
SSDEEP
393216:9+UwaZAOnzDdQuslN/m3p5Iwd4nqPMfU6BJHcRlvJuy0awDu:UeA4vdQu4K5x4nq0UQ8XxuhawDu
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
policy.exepid process 1800 policy.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
policy.exedescription pid process target process PID 1412 wrote to memory of 1800 1412 policy.exe policy.exe PID 1412 wrote to memory of 1800 1412 policy.exe policy.exe PID 1412 wrote to memory of 1800 1412 policy.exe policy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Policy Update\policy.exe"C:\Users\Admin\AppData\Local\Temp\Policy Update\policy.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Policy Update\policy.exe"C:\Users\Admin\AppData\Local\Temp\Policy Update\policy.exe"2⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI14122\python310.dllFilesize
4.3MB
MD5342ba224fe440b585db4e9d2fc9f86cd
SHA1bfa3d380231166f7c2603ca89a984a5cad9752ab
SHA256cdb8158dcf4f10517bd73e1334fc354fd98180d4455f29e3df2b0aa699fa2432
SHA512daa990ff3770a39b778f672f2596ab4050bff9b16bb2222e5712327df82d18f39ac5100e3b592a5db9e88302e6e94c06881fbf61431e7670ff287f7f222254c1
-
\Users\Admin\AppData\Local\Temp\_MEI14122\python310.dllFilesize
4.3MB
MD5342ba224fe440b585db4e9d2fc9f86cd
SHA1bfa3d380231166f7c2603ca89a984a5cad9752ab
SHA256cdb8158dcf4f10517bd73e1334fc354fd98180d4455f29e3df2b0aa699fa2432
SHA512daa990ff3770a39b778f672f2596ab4050bff9b16bb2222e5712327df82d18f39ac5100e3b592a5db9e88302e6e94c06881fbf61431e7670ff287f7f222254c1
-
memory/1412-54-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1800-55-0x0000000000000000-mapping.dmp