Analysis
-
max time kernel
19s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-10-2022 23:47
General
-
Target
a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe
-
Size
1.8MB
-
MD5
02f813c6b622223a466d802718ff6cbc
-
SHA1
734d0bb7aa3a3a0dc2361b8e030050b30f2c4679
-
SHA256
a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3
-
SHA512
c6078cccb314792e281d3edddf6b6fdffe29d95491d139113bff07e2534d0a3ac953a0c418c59b495c2c304e640d1c707f686c857f68b077dda3cb81a8ad837d
-
SSDEEP
24576:zMb5VwldaJxVkUDIUVUubQwE2qr2dHlz8M3PcFikGQp0MIzSgMs2SF1P:z45immUDIUVUucwE3KzbHQp0WtSF
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe"C:\Users\Admin\AppData\Local\Temp\a7bd0f79fceac4f399e071400776b7d33909831f1ee3955b12f6ef48198f92b3.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\nz92.exeC:\WINDOWS\nz92.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WinHvqf32.exe"C:\Windows\system32\WinHvqf32.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD5c7677623e4429d99e90ce71e90813c9d
SHA198498570715bd76735a08377a1cbf008780a3065
SHA25668039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267
SHA512f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f
-
Filesize
17KB
MD5c7677623e4429d99e90ce71e90813c9d
SHA198498570715bd76735a08377a1cbf008780a3065
SHA25668039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267
SHA512f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f
-
Filesize
17KB
MD5c7677623e4429d99e90ce71e90813c9d
SHA198498570715bd76735a08377a1cbf008780a3065
SHA25668039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267
SHA512f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f
-
Filesize
17KB
MD5c7677623e4429d99e90ce71e90813c9d
SHA198498570715bd76735a08377a1cbf008780a3065
SHA25668039b861f8426e90d1c2ce0bb21c922e7aeaecf5d8b90ce0c47d1ba61199267
SHA512f40d8897822978bcd8e956fcad0f49f634a222b1998e4c5857f5ffc2afdda25c34e8e14fdf0c5f9aaa5e2009ce7bc8c7ccb62175c0641014acae4d4125f67b8f
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB