Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
11-10-2022 08:14
General
-
Target
1f9e6f25014b732d66ca0c90cc67fae0b97d92f285208cf5ed9d296d2e902a27.exe
-
Size
239KB
-
MD5
70723927bd50ea337f1a59ca1a0a24c0
-
SHA1
d8a2fb5c3652bb1e0a840658562aed3caff49591
-
SHA256
1f9e6f25014b732d66ca0c90cc67fae0b97d92f285208cf5ed9d296d2e902a27
-
SHA512
16f42d49829020adb0e759eb569f64fa4a70b26b4ffacde6d98413d0dfddc9acc9b29c073281b001bc032ed27560e8be5525433beb426f0da8d88d3deaae85a0
-
SSDEEP
6144:ccfqGJSFKnLQXBgBrX227mz4DgAxOvKWr8:/tJS40x0pDgAxOv/8
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f9e6f25014b732d66ca0c90cc67fae0b97d92f285208cf5ed9d296d2e902a27.exe"C:\Users\Admin\AppData\Local\Temp\1f9e6f25014b732d66ca0c90cc67fae0b97d92f285208cf5ed9d296d2e902a27.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
420KB
-
Filesize
472KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB