Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 14:34
General
-
Target
394a34bc57fa33949ba76ae7f6df20286a5593f6e7e8e850da34b0b7328d3207.exe
-
Size
183KB
-
MD5
cae5375edf4df5c7e703de7466194367
-
SHA1
a6f60837bf37c64800d7333695cc63b9aad2a967
-
SHA256
394a34bc57fa33949ba76ae7f6df20286a5593f6e7e8e850da34b0b7328d3207
-
SHA512
7d083bb26c378a58aca53ae14da5a966b459c0ea7e16fcece3de5f14c68edf95132d7cc754eda550dbf074dbc5209af5616b1e7aeff640be62d09d4c01ff4745
-
SSDEEP
3072:KBPUQsZZQvSq8QM6L8QZ6UV8Q+UZOi9CDDwTgVEZM1n87fhzGlu4I:wxsZL7QM6L8QZ668cZOi4wi9afw
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 8 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\394a34bc57fa33949ba76ae7f6df20286a5593f6e7e8e850da34b0b7328d3207.exe"C:\Users\Admin\AppData\Local\Temp\394a34bc57fa33949ba76ae7f6df20286a5593f6e7e8e850da34b0b7328d3207.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
176KB
-
Filesize
192KB
-
Filesize
176KB
-
Filesize
32KB