Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 14:38
General
-
Target
32faa6dd8ce43d80a00e420b083f1084d705fbc022ae87979c5ad73949df4b79.exe
-
Size
224KB
-
MD5
f8618ef11432e37cc9954515a98b40c7
-
SHA1
713d6f84ddaa638bb72b844bd375205e75ffe436
-
SHA256
32faa6dd8ce43d80a00e420b083f1084d705fbc022ae87979c5ad73949df4b79
-
SHA512
3b63bdf903eac5b4e3d6610c978c9201198e33f5e7d7141ac1c657ab4d60a304461ffb0a75d8a147e3dc779d696d8807aa5acd792d8446b869c174fb6a3c5c69
-
SSDEEP
6144:yNBl76cpETWpZxcsvaSzjsQLSp0Dk7QHmvgKQ:6l76cMKYsvaS4R7xVQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Deletes itself 1 IoCs
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\32faa6dd8ce43d80a00e420b083f1084d705fbc022ae87979c5ad73949df4b79.exe"C:\Users\Admin\AppData\Local\Temp\32faa6dd8ce43d80a00e420b083f1084d705fbc022ae87979c5ad73949df4b79.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
2KB
MD5bc2526a2f30f75f588eb7aa0638512e9
SHA1dd33441682a55706d173762330dc78d3d884d4bb
SHA25600e7f6583bba117dfe857f94b54272f8b12fd3251ab472880950e390a95c0d24
SHA5129ac8ad431a4ee6027a8f8a14676cb61e075223f77f8e73385fb4885db4b38367a9736fddeecc08ea6871926fdf37c648e75bcdd8b282a61d98c5c9b57b8d50de
-
Filesize
52KB
MD56bf2039986af96d98e08824ac6c383fd
SHA10bb6384656a96943cb427baa92446f987219a02e
SHA256a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f
SHA512fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e
-
Filesize
68KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-