Analysis
-
max time kernel
108s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
07-11-2022 12:06
General
-
Target
800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c.exe
-
Size
238KB
-
MD5
0d409704c91e5deacf223171ac151ecf
-
SHA1
b73e480140f12569ab4e711fab9373a9abd2997d
-
SHA256
800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c
-
SHA512
18300f35da339d0651740ff6d94d517bd6d18cc583b3a835078019a76841d93d084e9df193f10380e0f5eff0ffef391ea341416abba57c4d61f834ad47a47be0
-
SSDEEP
6144:JP8Xqjo+np9KpsXmOo0pfqXwL0EL30+EpsPq8mFqjwGOlsM6/:JPKOHn3j/+wjVPnYusi/
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c.exe"C:\Users\Admin\AppData\Local\Temp\800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ukg.exe"C:\Users\Admin\AppData\Local\ukg.exe" -gav C:\Users\Admin\AppData\Local\Temp\800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c.exe2⤵
- Executes dropped EXE
- Deletes itself
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5601⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238KB
MD50d409704c91e5deacf223171ac151ecf
SHA1b73e480140f12569ab4e711fab9373a9abd2997d
SHA256800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c
SHA51218300f35da339d0651740ff6d94d517bd6d18cc583b3a835078019a76841d93d084e9df193f10380e0f5eff0ffef391ea341416abba57c4d61f834ad47a47be0
-
Filesize
238KB
MD50d409704c91e5deacf223171ac151ecf
SHA1b73e480140f12569ab4e711fab9373a9abd2997d
SHA256800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c
SHA51218300f35da339d0651740ff6d94d517bd6d18cc583b3a835078019a76841d93d084e9df193f10380e0f5eff0ffef391ea341416abba57c4d61f834ad47a47be0
-
Filesize
238KB
MD50d409704c91e5deacf223171ac151ecf
SHA1b73e480140f12569ab4e711fab9373a9abd2997d
SHA256800e3ee3577ab68f8e14a6b9498cc66e2fc7107e22568e7f8c501a2af2f0504c
SHA51218300f35da339d0651740ff6d94d517bd6d18cc583b3a835078019a76841d93d084e9df193f10380e0f5eff0ffef391ea341416abba57c4d61f834ad47a47be0
-
Filesize
8KB
-
Filesize
896KB
-
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
8KB
-
Filesize
896KB
-
Filesize
896KB
-
Filesize
896KB