Analysis
-
max time kernel
78s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 19:50
General
-
Target
b50670e48fc3bfe9411fc256c1c78c1b553e7fba7fca572e9fa23365dd820080.exe
-
Size
65KB
-
MD5
597295614ee253687244e3414c3a23f0
-
SHA1
1946bf4fd1ec3f8b1f251a90952cad623c1383a7
-
SHA256
b50670e48fc3bfe9411fc256c1c78c1b553e7fba7fca572e9fa23365dd820080
-
SHA512
5c936d74a2611686cc2533b1a544c92fccc2640f8a31dcd6bb340dd44e7d30a1ce5a701e6addef5f00ffbb98dffac81831a2b07968e27ced554f8a8a12f3c017
-
SSDEEP
1536:2V0mTTtDOYjc9PqAnfWyGzAAClqKPLJ9mu6KoE9apYFsSPdkD6liAW2nylBZolwC:2DRUkf3hC4KPN936tE9PjdkD6liAWjl2
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b50670e48fc3bfe9411fc256c1c78c1b553e7fba7fca572e9fa23365dd820080.exe"C:\Users\Admin\AppData\Local\Temp\b50670e48fc3bfe9411fc256c1c78c1b553e7fba7fca572e9fa23365dd820080.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
88KB