Overview

overview

6

Static

static

ae47eec963...6e.exe

windows7-x64

6

ae47eec963...6e.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    152s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 13:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae47eec96331b3ac2a0de3345b6c7c977c266673cd4d264e1cffa5f5ce3fbf6e.exe

  • Size

    436KB

  • MD5

    5dd6e69b1e9049f295e314b523679d98

  • SHA1

    d17f17311a2142da92acd195c0511a4275193737

  • SHA256

    ae47eec96331b3ac2a0de3345b6c7c977c266673cd4d264e1cffa5f5ce3fbf6e

  • SHA512

    8aa995067b8c399f2da65b9a302ded654f51a70bc93701801eb39564c344deebe577b891e3e23771494151360972c340c8261b573c15df24686d9cc431d59c2c

  • SSDEEP

    6144:kX9Lng9HytfmZnn2gktn7DfDDBr+DvSIHqD9f9QIuIi5sy24R2RPk1w:yLnwlgPfDDBJHSwkck

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae47eec96331b3ac2a0de3345b6c7c977c266673cd4d264e1cffa5f5ce3fbf6e.exe
    "C:\Users\Admin\AppData\Local\Temp\ae47eec96331b3ac2a0de3345b6c7c977c266673cd4d264e1cffa5f5ce3fbf6e.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1904-134-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/1904-135-0x0000000000400000-0x000000000046E000-memory.dmp
    Filesize

    440KB

    Download
  • memory/1904-138-0x0000000000400000-0x000000000044E000-memory.dmp
    Filesize

    312KB

    Download
  • memory/2376-136-0x0000000003240000-0x000000000326E000-memory.dmp
    Filesize

    184KB

    Download
  • memory/2376-137-0x0000000003270000-0x00000000032A3000-memory.dmp
    Filesize

    204KB

    Download
  • memory/2376-139-0x00000000037D0000-0x0000000003803000-memory.dmp
    Filesize

    204KB

    Download