Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29/10/2022, 19:10
General
-
Target
9e10f89a718ea6c296d6079eae1b2e1d7f32bdfcba11a9a8d8f6c7ee1bca333d.exe
-
Size
310KB
-
MD5
8405c44ea39c1e89ab347380ed8d8941
-
SHA1
ecd6172ceabc9ba534780c71c3a0fcd743338d63
-
SHA256
9e10f89a718ea6c296d6079eae1b2e1d7f32bdfcba11a9a8d8f6c7ee1bca333d
-
SHA512
2534c3991afae603bfe1090b3c4df5c527f93c354477143fdc4658aadd54aa0d37d2d74b430fb0d895231f636f35e63dd322786826d69cef2e9ff6e4d207be64
-
SSDEEP
6144:GWsS02/oPbqhjCVTS/EGQalR+pSXSYZaKYxzXpztpz6cI0:CS0YI5FS/vQxBYQtzRVI0
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e10f89a718ea6c296d6079eae1b2e1d7f32bdfcba11a9a8d8f6c7ee1bca333d.exe"C:\Users\Admin\AppData\Local\Temp\9e10f89a718ea6c296d6079eae1b2e1d7f32bdfcba11a9a8d8f6c7ee1bca333d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pPiAnOb01804\pPiAnOb01804.exe"C:\ProgramData\pPiAnOb01804\pPiAnOb01804.exe" "C:\Users\Admin\AppData\Local\Temp\9e10f89a718ea6c296d6079eae1b2e1d7f32bdfcba11a9a8d8f6c7ee1bca333d.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310KB
MD5fd531b23b2670cc03a17c46cc8089890
SHA1217175cc9ef9d3f84818f2006c80b21205e9f2f4
SHA256ad1d1df5cf7399845e7a33411ba26ddea1d09ccc17e68e7ac1930ac490179abd
SHA512100801885c70e30ae07bc799bc51627d7f3e4695743cab76d7965ed2e12370c70b255477a2c776ecdbedbbca97669db96388e4d55fac44b11b70a5533b7f9edd
-
Filesize
310KB
MD5fd531b23b2670cc03a17c46cc8089890
SHA1217175cc9ef9d3f84818f2006c80b21205e9f2f4
SHA256ad1d1df5cf7399845e7a33411ba26ddea1d09ccc17e68e7ac1930ac490179abd
SHA512100801885c70e30ae07bc799bc51627d7f3e4695743cab76d7965ed2e12370c70b255477a2c776ecdbedbbca97669db96388e4d55fac44b11b70a5533b7f9edd
-
Filesize
310KB
MD5fd531b23b2670cc03a17c46cc8089890
SHA1217175cc9ef9d3f84818f2006c80b21205e9f2f4
SHA256ad1d1df5cf7399845e7a33411ba26ddea1d09ccc17e68e7ac1930ac490179abd
SHA512100801885c70e30ae07bc799bc51627d7f3e4695743cab76d7965ed2e12370c70b255477a2c776ecdbedbbca97669db96388e4d55fac44b11b70a5533b7f9edd
-
Filesize
310KB
MD5fd531b23b2670cc03a17c46cc8089890
SHA1217175cc9ef9d3f84818f2006c80b21205e9f2f4
SHA256ad1d1df5cf7399845e7a33411ba26ddea1d09ccc17e68e7ac1930ac490179abd
SHA512100801885c70e30ae07bc799bc51627d7f3e4695743cab76d7965ed2e12370c70b255477a2c776ecdbedbbca97669db96388e4d55fac44b11b70a5533b7f9edd
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
8KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB