Analysis
-
max time kernel
170s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
06/11/2022, 14:04
General
-
Target
7aab50d132aac6d04d58886d57eab678205b6775c19172aec3cfc2231357b244.exe
-
Size
197KB
-
MD5
0d7ee5ca2ad2f1ff8dc76b0b3e46a879
-
SHA1
4fb3d2a4c3d8dd10d41f88fa406a8b57df86afd2
-
SHA256
7aab50d132aac6d04d58886d57eab678205b6775c19172aec3cfc2231357b244
-
SHA512
b2ebff2aab02fa2f0184aa7532c27c45ef0eb5c344439ab4ecb50861ebe83a5eff0c213917f0e25b967e123a3e99ea8cac8b886eaa7d2cd6c8f1aaef2ef255ff
-
SSDEEP
3072:LVHat+arJxGCKOpb+cMh0tcxW0r4MZ8NlV4OmfOcRdMj0qegl44kVS1eWDTTeGNq:ejwcMh0tcU0D+l6NfOG2Vfl442SA6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aab50d132aac6d04d58886d57eab678205b6775c19172aec3cfc2231357b244.exe"C:\Users\Admin\AppData\Local\Temp\7aab50d132aac6d04d58886d57eab678205b6775c19172aec3cfc2231357b244.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Nsohya.exeC:\Windows\Nsohya.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
197KB
MD50d7ee5ca2ad2f1ff8dc76b0b3e46a879
SHA14fb3d2a4c3d8dd10d41f88fa406a8b57df86afd2
SHA2567aab50d132aac6d04d58886d57eab678205b6775c19172aec3cfc2231357b244
SHA512b2ebff2aab02fa2f0184aa7532c27c45ef0eb5c344439ab4ecb50861ebe83a5eff0c213917f0e25b967e123a3e99ea8cac8b886eaa7d2cd6c8f1aaef2ef255ff
-
Filesize
408B
MD5fb712f8a06bfd1bff6f690f5cd8a9f3c
SHA1c46560f544a35b9b0bfffbbde60fd712df1deeb4
SHA256ef0b65be9966aab7b08d39e8125e74aa511e2968fd605e8ecd9ceb093b1b9e14
SHA5129704f7a46cdd2ef4119bd864a3ddab750e6a9aa1b7a3c6105610915eb08f144e67626c384ce3b581338f13d75ea5ce8fd355dc57aab20b36fa3562289ba20885
-
Filesize
280KB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB