Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
24-11-2022 22:21
General
-
Target
8ebef10661973654d41d225ecf491417cb6624a90d3d1dc94408bab0fc1a6bfa.exe
-
Size
154KB
-
MD5
f568feb9d9e52e6ca4a2e9c2aa7b6ac1
-
SHA1
1d54221b8506a4eefe98d7071ec2621c3892bda6
-
SHA256
8ebef10661973654d41d225ecf491417cb6624a90d3d1dc94408bab0fc1a6bfa
-
SHA512
ee01d4806a2b0f88fb0cc9e7763f41e5dd14f5f34cb64d3e947878ab138ae61c2c390df923f799226fc73ec713c6511982f94f3f4b454d998dd6d32cdb4656e2
-
SSDEEP
3072:nxbv6QZjOhmD7D2t40Dmq+1b3IHhAF0EL+z+G6j/wGoJ+2:nxbCBc2t40aq+1sGF0Exj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\8ebef10661973654d41d225ecf491417cb6624a90d3d1dc94408bab0fc1a6bfa.exe"C:\Users\Admin\AppData\Local\Temp\8ebef10661973654d41d225ecf491417cb6624a90d3d1dc94408bab0fc1a6bfa.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\nFilesize
25KB
MD5031f24073b43717e018ba0c5f62cb0c2
SHA1504008e17d774bdfd3996ce8cf521277ca620ca9
SHA2569abdc34bee90330fa2505f0c3f74eda6036e5adf22cc8bcd57192d0bf6f17946
SHA512c9a163bc5cd6171013e38ee418737f0ee383b733090648d8879b259b0659d803c23d2e62b6e34e9897c436f35984ccc4f29d552a975f03292774834279f07d37
-
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\nFilesize
25KB
MD5031f24073b43717e018ba0c5f62cb0c2
SHA1504008e17d774bdfd3996ce8cf521277ca620ca9
SHA2569abdc34bee90330fa2505f0c3f74eda6036e5adf22cc8bcd57192d0bf6f17946
SHA512c9a163bc5cd6171013e38ee418737f0ee383b733090648d8879b259b0659d803c23d2e62b6e34e9897c436f35984ccc4f29d552a975f03292774834279f07d37
-
memory/4840-132-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4840-133-0x00000000005AF000-0x00000000005CE000-memory.dmpFilesize
124KB
-
memory/4840-136-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/4840-137-0x00000000005AF000-0x00000000005CE000-memory.dmpFilesize
124KB