Analysis
-
max time kernel
152s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
19/10/2022, 21:42
General
-
Target
c96e559800b081e762c21026abb7691c3a3311df1a69d9a624944cf39e1b750e.exe
-
Size
302KB
-
MD5
836556815b49dd6af1e197106519392b
-
SHA1
5bd161f27c28679404a6cca65bbbb99c8c4e105b
-
SHA256
c96e559800b081e762c21026abb7691c3a3311df1a69d9a624944cf39e1b750e
-
SHA512
9b7c3e46c93730d37bb9d6ab672aae9627c7570414a3ffb5d0a2cb6ed32234def0d19e1f370581a2974943b5cec340893e550bb39a9a364f4da779a265993f14
-
SSDEEP
6144:/vHL6XwP2odP8HsCmsnp6cpaGevC5EAa0saI9VR/zH:/vfPbZ8gvB
Score
8/10
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\c96e559800b081e762c21026abb7691c3a3311df1a69d9a624944cf39e1b750e.exe"C:\Users\Admin\AppData\Local\Temp\c96e559800b081e762c21026abb7691c3a3311df1a69d9a624944cf39e1b750e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
315KB
-
Filesize
4.1MB
-
Filesize
315KB
-
Filesize
315KB