Analysis
-
max time kernel
116s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 15:23
Static task
static1
Behavioral task
behavioral1
Sample
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe
Resource
win10v2004-20220812-en
General
-
Target
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe
-
Size
8.7MB
-
MD5
1b553e61afa85bc3a2ccd477ee9c85ff
-
SHA1
8f4f6599750aa368bdf528c36f475da1f12ea7b4
-
SHA256
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f
-
SHA512
f0ab9acafd8a4e8a1220f24a72221498073365ebb1338ebba54a83b4770721a4415d515cb7bf591aa2442bca9bd9d7c43b32dd2d6a78f27708b7aca5605e94ca
-
SSDEEP
196608:/9f7wiIh46u4lUq/0z6DuEf46g4MH2bOAvNGTHoPyDQ8mfz:/Z72hdu8/0z6BPM+zGLoas8mfz
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\wificonec = "C:\\Users\\Admin\\AppData\\Local\\Temp\\124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe" 124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exepid process 1996 124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exepid process 1996 124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exepid process 1996 124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe"C:\Users\Admin\AppData\Local\Temp\124ade72ef8124cf22cf01774515239e1e310fb2cfe450210ea94a54b2d0aa1f.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1996-54-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1996-55-0x0000000000400000-0x00000000018D7000-memory.dmpFilesize
20.8MB
-
memory/1996-56-0x0000000000400000-0x00000000018D7000-memory.dmpFilesize
20.8MB
-
memory/1996-57-0x0000000005C00000-0x0000000005C83000-memory.dmpFilesize
524KB
-
memory/1996-58-0x0000000000400000-0x00000000018D7000-memory.dmpFilesize
20.8MB