Analysis
-
max time kernel
169s -
max time network
179s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 14:33
General
-
Target
3ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b.exe
-
Size
316KB
-
MD5
461da96893de41f57cbf054baec185ac
-
SHA1
bfb4ccc749153cdf3561cc90deb56e0de5917d98
-
SHA256
3ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b
-
SHA512
0f263a8469d39756f3d8d7c137f31c468f95bb1e20ba58987a953908af3d89fdf239934e3cba294609830ffefec6b6da1c39b32dc7e76495385633276d2a6fce
-
SSDEEP
6144:DeeNvVM6B9GyRYSP+fF0f2t6b+vClRHUcivtJOkRGP07ByaB22U9F/Ps:DeeNvVM6B0yaSWfFZt6KqlKRvtJOkRG8
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 17 IoCs
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Modifies registry class 41 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 35 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b.exe"C:\Users\Admin\AppData\Local\Temp\3ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\efo.exe"C:\Users\Admin\AppData\Local\efo.exe" -gav C:\Users\Admin\AppData\Local\Temp\3ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b.exe2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5461da96893de41f57cbf054baec185ac
SHA1bfb4ccc749153cdf3561cc90deb56e0de5917d98
SHA2563ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b
SHA5120f263a8469d39756f3d8d7c137f31c468f95bb1e20ba58987a953908af3d89fdf239934e3cba294609830ffefec6b6da1c39b32dc7e76495385633276d2a6fce
-
Filesize
316KB
MD5461da96893de41f57cbf054baec185ac
SHA1bfb4ccc749153cdf3561cc90deb56e0de5917d98
SHA2563ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b
SHA5120f263a8469d39756f3d8d7c137f31c468f95bb1e20ba58987a953908af3d89fdf239934e3cba294609830ffefec6b6da1c39b32dc7e76495385633276d2a6fce
-
Filesize
316KB
MD5461da96893de41f57cbf054baec185ac
SHA1bfb4ccc749153cdf3561cc90deb56e0de5917d98
SHA2563ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b
SHA5120f263a8469d39756f3d8d7c137f31c468f95bb1e20ba58987a953908af3d89fdf239934e3cba294609830ffefec6b6da1c39b32dc7e76495385633276d2a6fce
-
Filesize
316KB
MD5461da96893de41f57cbf054baec185ac
SHA1bfb4ccc749153cdf3561cc90deb56e0de5917d98
SHA2563ac1dccdd270dd81d0b4a8a84f62db1a7019c2b133f1d1a19aeee55a576f8f8b
SHA5120f263a8469d39756f3d8d7c137f31c468f95bb1e20ba58987a953908af3d89fdf239934e3cba294609830ffefec6b6da1c39b32dc7e76495385633276d2a6fce
-
Filesize
8KB
-
Filesize
2.0MB
-
-
Filesize
24KB
-
Filesize
2.0MB
-
Filesize
8KB
-
Filesize
2.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
24KB
-
Filesize
36KB
-
Filesize
8KB