Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 11:13
General
-
Target
7a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393.exe
-
Size
432KB
-
MD5
a2f89856077e45aef0ec6003395562b2
-
SHA1
5426352908cad54e23554fce53ebe24b4b871555
-
SHA256
7a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393
-
SHA512
0713b31425e58466f1f6ce2b1dfff83a98565af0111b7c3b5cb79db692a1285821ef631a0521661796d5d82d7aea06ccac00d8f4f6fd54ac21dee3ee90f6c5c9
-
SSDEEP
12288:AwoaPQAxxuzkZC0Kw2GCGQP/lcAITEyv:ro/AOWFJ9JQlcZY
Malware Config
Signatures
-
Windows security bypass 2 TTPs 10 IoCs
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393.exe"C:\Users\Admin\AppData\Local\Temp\7a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe"C:\ProgramData\F4D55F6500014973000CAE15B4EB2331\F4D55F6500014973000CAE15B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\7a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Deletes itself
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
432KB
MD5a2f89856077e45aef0ec6003395562b2
SHA15426352908cad54e23554fce53ebe24b4b871555
SHA2567a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393
SHA5120713b31425e58466f1f6ce2b1dfff83a98565af0111b7c3b5cb79db692a1285821ef631a0521661796d5d82d7aea06ccac00d8f4f6fd54ac21dee3ee90f6c5c9
-
Filesize
432KB
MD5a2f89856077e45aef0ec6003395562b2
SHA15426352908cad54e23554fce53ebe24b4b871555
SHA2567a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393
SHA5120713b31425e58466f1f6ce2b1dfff83a98565af0111b7c3b5cb79db692a1285821ef631a0521661796d5d82d7aea06ccac00d8f4f6fd54ac21dee3ee90f6c5c9
-
Filesize
432KB
MD5a2f89856077e45aef0ec6003395562b2
SHA15426352908cad54e23554fce53ebe24b4b871555
SHA2567a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393
SHA5120713b31425e58466f1f6ce2b1dfff83a98565af0111b7c3b5cb79db692a1285821ef631a0521661796d5d82d7aea06ccac00d8f4f6fd54ac21dee3ee90f6c5c9
-
Filesize
432KB
MD5a2f89856077e45aef0ec6003395562b2
SHA15426352908cad54e23554fce53ebe24b4b871555
SHA2567a5be5133a68d24f8ceae3cb3164dcbd50dddfbed799a68580771fa28acbd393
SHA5120713b31425e58466f1f6ce2b1dfff83a98565af0111b7c3b5cb79db692a1285821ef631a0521661796d5d82d7aea06ccac00d8f4f6fd54ac21dee3ee90f6c5c9
-
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB