Analysis
-
max time kernel
175s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
26-11-2022 22:44
General
-
Target
4ceb8e7d3677b4e0d1dcd629f50f03d2e7d5c823d05580597c9b418d0c7c4eb6.exe
-
Size
268KB
-
MD5
28286fde8ff1eb1407219eb1c886b852
-
SHA1
61aa1401af5881dc918887c37e831dbe541c3550
-
SHA256
4ceb8e7d3677b4e0d1dcd629f50f03d2e7d5c823d05580597c9b418d0c7c4eb6
-
SHA512
3b0c784854f3ab484e8a045eddfc80440ceb7dbc5c4930c39534b334931727d774f535e34602e84e56840f8f38bb9a5b9bbb23bd0379bf32061ae8c2cb19cb47
-
SSDEEP
3072:buXpC6u24Vq6zCheDbuK+PU1v2jQHoLM4LtdP/B3qGQzCCF7U8n3+46tv6N:wp1uYhHPU2/dNqRjn3+bv+
Score
7/10
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ceb8e7d3677b4e0d1dcd629f50f03d2e7d5c823d05580597c9b418d0c7c4eb6.exe"C:\Users\Admin\AppData\Local\Temp\4ceb8e7d3677b4e0d1dcd629f50f03d2e7d5c823d05580597c9b418d0c7c4eb6.exe"1⤵
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.2MB