Analysis
-
max time kernel
152s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-10-2022 09:33
General
-
Target
0d1363d0ac11870144d9797b2ac11939e73ba9da7ee35a5ef1dc8f0b64ffb5c3.exe
-
Size
376KB
-
MD5
72080922f881214e83321f217f181bdc
-
SHA1
cdebd34979899428e718c2c12efcff6cf3d36e8d
-
SHA256
0d1363d0ac11870144d9797b2ac11939e73ba9da7ee35a5ef1dc8f0b64ffb5c3
-
SHA512
947d891cf452d45fd4513335ac65d0d934334c3dd4d467da4ef55f108f8d83b929e65c1991b14c03d408b155523d3198753af5106de4168c7424d3e5d273fcc7
-
SSDEEP
6144:M4RaYootbLhs/d2bBL44LEXOTWKRxETrpDD2CpkZtJ5J7ZYAx08xRAj:qYJnY+lyX4LnLZpxf
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d1363d0ac11870144d9797b2ac11939e73ba9da7ee35a5ef1dc8f0b64ffb5c3.exe"C:\Users\Admin\AppData\Local\Temp\0d1363d0ac11870144d9797b2ac11939e73ba9da7ee35a5ef1dc8f0b64ffb5c3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\hI12602KfIoI12602\hI12602KfIoI12602.exe"\hI12602KfIoI12602\hI12602KfIoI12602.exe" "C:\Users\Admin\AppData\Local\Temp\0d1363d0ac11870144d9797b2ac11939e73ba9da7ee35a5ef1dc8f0b64ffb5c3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3484 -s 7203⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4396 -ip 43961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3484 -ip 34841⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD57a7cf460fe30eb791e2b72c5feabba95
SHA179c5e2927a45e3af8acdefceabee98bbe37d6149
SHA2567b00216ddf7cee47fe45a51e300b2542f030d61b64964a5232eec7e83de6ab75
SHA5126acc10319f14301b1f9fcfb21c71c70f84965106a0268051e1ff32cc11ec7d9cc616c6430c6a9f857c1d59b6580ebf42feb2c7583e647f870f1cf63409bb6248
-
Filesize
376KB
MD57a7cf460fe30eb791e2b72c5feabba95
SHA179c5e2927a45e3af8acdefceabee98bbe37d6149
SHA2567b00216ddf7cee47fe45a51e300b2542f030d61b64964a5232eec7e83de6ab75
SHA5126acc10319f14301b1f9fcfb21c71c70f84965106a0268051e1ff32cc11ec7d9cc616c6430c6a9f857c1d59b6580ebf42feb2c7583e647f870f1cf63409bb6248
-
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
12KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB