Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
29/10/2022, 13:29
General
-
Target
cf3e3a9b003e109efbbbeddcd85fb692354d90d1c10673976fd8d5406cc70144.exe
-
Size
70KB
-
MD5
0a17f1947f34d487a1340e70d71f8c4b
-
SHA1
cc4726d9bb28cf28d661aeae9e6b50de0417c83c
-
SHA256
cf3e3a9b003e109efbbbeddcd85fb692354d90d1c10673976fd8d5406cc70144
-
SHA512
61da36e6eb7381d512a5e19f677041f2fc6d74e6c9dcabc52b3ad8c7965266f0e0fbc89e549765b26f1929ae72a13f2d76ab3801bd89f922e4b8a07c13f15caa
-
SSDEEP
1536:G5KMGwMPrZ3SNmLQLhz/sgoouGS/f/JaAg9uXvWSAoh9:G6DVSNmEzUpBpo9ob9
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf3e3a9b003e109efbbbeddcd85fb692354d90d1c10673976fd8d5406cc70144.exe"C:\Users\Admin\AppData\Local\Temp\cf3e3a9b003e109efbbbeddcd85fb692354d90d1c10673976fd8d5406cc70144.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\td49vvt3tq32vme\Dxqbxfe.exelaunch2⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
-
Filesize
8KB
-
Filesize
116KB
-
Filesize
206KB
-
Filesize
208KB
-
Filesize
208KB