Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-11-2022 09:09
General
-
Target
52979f4467861dfa2bb5226b7cd02780db0af0c60e7bce157538ff1090f073b0.exe
-
Size
271KB
-
MD5
6e5c770642e74febfbc609703959e39a
-
SHA1
2fe21b85b7c1652e5db461dcce6729410a529379
-
SHA256
52979f4467861dfa2bb5226b7cd02780db0af0c60e7bce157538ff1090f073b0
-
SHA512
49cd9402c45ca89cba868602badae53b2a5db7aad60270b4dd516aa3b47685ab70c036c44c55ec6bf64763bfb468292c4643bf71d83be09ca9cd37dac8986a3b
-
SSDEEP
6144:V6Y4SDmnkDTrYCL2th1i4XPW42cglluj4bQpnofsn:V6Y4SDmnkoLi4+/f8Mbyo
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52979f4467861dfa2bb5226b7cd02780db0af0c60e7bce157538ff1090f073b0.exe"C:\Users\Admin\AppData\Local\Temp\52979f4467861dfa2bb5226b7cd02780db0af0c60e7bce157538ff1090f073b0.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
372KB
-
Filesize
8KB
-
Filesize
420KB
-
Filesize
372KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB