Analysis
-
max time kernel
145s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-11-2022 04:07
General
-
Target
a3d4e0ce0b5583d94677131be80a4d83ef4baba9f4e89e610840e9903ff100b1.exe
-
Size
243KB
-
MD5
97a508f2b6823ec2818259c64ff56c8c
-
SHA1
3096fcdec8cceea94086843267e33ab78b1326e1
-
SHA256
a3d4e0ce0b5583d94677131be80a4d83ef4baba9f4e89e610840e9903ff100b1
-
SHA512
957d7fdd89b63628e2f0f489a8d34d4e9af7879021ac201cb736153816a0724416e4eef445392a432c2d9ebf4d8a2f4e14a8f2aad2f57742ae6c6e9546f44c01
-
SSDEEP
6144:TnScTKd/ASzisjWzxCyEBQFyTrfdiaXuQtqc7YKqkYh:VTKCS2sjWC1rfd/Rtqc7HqkYh
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3d4e0ce0b5583d94677131be80a4d83ef4baba9f4e89e610840e9903ff100b1.exe"C:\Users\Admin\AppData\Local\Temp\a3d4e0ce0b5583d94677131be80a4d83ef4baba9f4e89e610840e9903ff100b1.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824KB
-
Filesize
8KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
296KB
-
Filesize
712KB
-
Filesize
824KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB