Analysis
-
max time kernel
48s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
19/10/2022, 21:34
General
-
Target
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe
-
Size
37KB
-
MD5
922268ef8785adb812525c3fd4372710
-
SHA1
1b440f720963596ba5fc4bdb3e5085528d1cb559
-
SHA256
d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d
-
SHA512
dc144e667e18bbe0241651b3cc10159d2653499c22d406d35f7bbcdf6e1c838d4522d4818c6ced3b3e77638943a26846a1d3aaddea1490d3954524a70b0b1837
-
SSDEEP
768:mtcXQU7ao9ALzICT5PlopIh+u7lf7OwxgV0nbcuyD7U0rsSKBdo:mtNHLzICTzh+uJzNnouy804Bdo
Score
8/10
Malware Config
Signatures
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe"C:\Users\Admin\AppData\Local\Temp\d77346745325751a39d77202e83af104ed44a7b02ba1545b909bad4160425b2d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
92KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
32KB