Analysis
-
max time kernel
152s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06-11-2022 23:54
General
-
Target
37a825189d284ab47c3aaa51a3429a9508ab7e163c6ddde5d63fa9ac6f702c01.exe
-
Size
145KB
-
MD5
07ec84d8013092fd2e69e5ace47df7b1
-
SHA1
1516f8f1b2ba1d75a2f05dda01d20aab56c8c2fd
-
SHA256
37a825189d284ab47c3aaa51a3429a9508ab7e163c6ddde5d63fa9ac6f702c01
-
SHA512
c414962cbdf63a40d99a206396da6dfb4a944513101796003a02aabe3e2556f7e571ffa7da793d30d785026caab3527200f275b85074d569c73cf3dced9484ac
-
SSDEEP
3072:qoCA+ZqexSegL00H2TXOAiTMeKZ8z76D98TvxRmrC:qoCA+ZqexSRLK6AQ3KZT+Tvbd
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37a825189d284ab47c3aaa51a3429a9508ab7e163c6ddde5d63fa9ac6f702c01.exe"C:\Users\Admin\AppData\Local\Temp\37a825189d284ab47c3aaa51a3429a9508ab7e163c6ddde5d63fa9ac6f702c01.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe /k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD56a231a654f4a24e68466674df82a3b1f
SHA1a4cf3dec747c6c4c22ae6865902e6d87e409eb82
SHA25634f215a71d21534a312b10f03e90ba402afd0be65fbc24de05bbe2066452d857
SHA5128aa1a618c390f6427fd46639dba7e022a8adae1d59455b6af005cc0a463ed1f75b1e03a2ed13c6deae6be1f35bf3d9bb5b3721b937531a0dd81efd77ecc92dfd
-
Filesize
128KB
MD56a231a654f4a24e68466674df82a3b1f
SHA1a4cf3dec747c6c4c22ae6865902e6d87e409eb82
SHA25634f215a71d21534a312b10f03e90ba402afd0be65fbc24de05bbe2066452d857
SHA5128aa1a618c390f6427fd46639dba7e022a8adae1d59455b6af005cc0a463ed1f75b1e03a2ed13c6deae6be1f35bf3d9bb5b3721b937531a0dd81efd77ecc92dfd
-
Filesize
8KB