Analysis

  • max time kernel
    133s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 09:28

General

  • Target

    f11a130df4d1819304707c176b535375f41f00ab6dcce09f167d33704dbc25fa.exe

  • Size

    484KB

  • MD5

    b8be0deb46ee19c5e612b1c5e22371b7

  • SHA1

    b62936f3db478e2296d090cb00615064489d2451

  • SHA256

    f11a130df4d1819304707c176b535375f41f00ab6dcce09f167d33704dbc25fa

  • SHA512

    e18660b57624a4e837f200ba47d199641862cd3c93be07f28984f728f112ddcc2a8a37906ae36a17eb92ea408a8e2f4619c3c3f4a18e91cc33835bea364083f8

  • SSDEEP

    12288:3chWZgCikuFGy7eonCHoQHodirBrIi8Go0:7ZgCW7eNHLrx8x0

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f11a130df4d1819304707c176b535375f41f00ab6dcce09f167d33704dbc25fa.exe
    "C:\Users\Admin\AppData\Local\Temp\f11a130df4d1819304707c176b535375f41f00ab6dcce09f167d33704dbc25fa.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Users\Admin\AppData\Local\Temp\qdpskxvxmgbtwy.exe
      "C:\Users\Admin\AppData\Local\Temp\\qdpskxvxmgbtwy.exe"
      2⤵
      • Executes dropped EXE
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1672

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\parent.txt

          Filesize

          484KB

          MD5

          b8be0deb46ee19c5e612b1c5e22371b7

          SHA1

          b62936f3db478e2296d090cb00615064489d2451

          SHA256

          f11a130df4d1819304707c176b535375f41f00ab6dcce09f167d33704dbc25fa

          SHA512

          e18660b57624a4e837f200ba47d199641862cd3c93be07f28984f728f112ddcc2a8a37906ae36a17eb92ea408a8e2f4619c3c3f4a18e91cc33835bea364083f8

        • C:\Users\Admin\AppData\Local\Temp\qdpskxvxmgbtwy.exe

          Filesize

          32KB

          MD5

          f12250682afd4e9b63be5bffbaef991c

          SHA1

          e4c718119fdd5421300520ea45f5da914ef1b1bd

          SHA256

          a49f96474edd004e75d4e92e9a4c165832487cbb11b58ea4664d7b7ca709ee44

          SHA512

          3c13b2173ec5f2f7b99ac0e1d341285824f18cb8393d36510470ce17e6cdb88ba91e1223a1cd952f5e07cecc4d06a0bd881a863d5733fa93610670744e53c96d

        • C:\Users\Admin\AppData\Local\Temp\qdpskxvxmgbtwy.exe

          Filesize

          32KB

          MD5

          f12250682afd4e9b63be5bffbaef991c

          SHA1

          e4c718119fdd5421300520ea45f5da914ef1b1bd

          SHA256

          a49f96474edd004e75d4e92e9a4c165832487cbb11b58ea4664d7b7ca709ee44

          SHA512

          3c13b2173ec5f2f7b99ac0e1d341285824f18cb8393d36510470ce17e6cdb88ba91e1223a1cd952f5e07cecc4d06a0bd881a863d5733fa93610670744e53c96d

        • \Users\Admin\AppData\Local\Temp\qdpskxvxmgbtwy.exe

          Filesize

          32KB

          MD5

          f12250682afd4e9b63be5bffbaef991c

          SHA1

          e4c718119fdd5421300520ea45f5da914ef1b1bd

          SHA256

          a49f96474edd004e75d4e92e9a4c165832487cbb11b58ea4664d7b7ca709ee44

          SHA512

          3c13b2173ec5f2f7b99ac0e1d341285824f18cb8393d36510470ce17e6cdb88ba91e1223a1cd952f5e07cecc4d06a0bd881a863d5733fa93610670744e53c96d

        • \Users\Admin\AppData\Local\Temp\qdpskxvxmgbtwy.exe

          Filesize

          32KB

          MD5

          f12250682afd4e9b63be5bffbaef991c

          SHA1

          e4c718119fdd5421300520ea45f5da914ef1b1bd

          SHA256

          a49f96474edd004e75d4e92e9a4c165832487cbb11b58ea4664d7b7ca709ee44

          SHA512

          3c13b2173ec5f2f7b99ac0e1d341285824f18cb8393d36510470ce17e6cdb88ba91e1223a1cd952f5e07cecc4d06a0bd881a863d5733fa93610670744e53c96d

        • memory/1672-59-0x000007FEF4680000-0x000007FEF50A3000-memory.dmp

          Filesize

          10.1MB

        • memory/1672-60-0x000007FEF35E0000-0x000007FEF4676000-memory.dmp

          Filesize

          16.6MB

        • memory/1672-62-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

          Filesize

          8KB