Analysis

  • max time kernel
    185s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 21:09

General

  • Target

    a98a34e3582fc71364f33e285a64f7460840265e85c7e2f125869ed72525da95.exe

  • Size

    20KB

  • MD5

    15b8f7096abb5d116445710362bd6000

  • SHA1

    4761469490802ca4968fb9475ac35f6f915fd7d5

  • SHA256

    a98a34e3582fc71364f33e285a64f7460840265e85c7e2f125869ed72525da95

  • SHA512

    d8d61ab76130f60b47bf9f908429cf56772ad17a03a67f83fbe83f58e981ca62e0cddb040b44afda9d03dec1209350c038a703e3df12c0251b944ca6b39ed1e6

  • SSDEEP

    384:Bf5Q7ubuzonQcD8t9jcyPkUNHLwF9RyQEX1gLAFlQYV4R:Bf5OusonQcgt9jcycUBLw5yQggk7tV4R

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a98a34e3582fc71364f33e285a64f7460840265e85c7e2f125869ed72525da95.exe
    "C:\Users\Admin\AppData\Local\Temp\a98a34e3582fc71364f33e285a64f7460840265e85c7e2f125869ed72525da95.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4268-132-0x0000000000400000-0x0000000000405AA0-memory.dmp

    Filesize

    22KB

  • memory/4268-133-0x0000000000400000-0x0000000000405AA0-memory.dmp

    Filesize

    22KB