Analysis
-
max time kernel
254s -
max time network
351s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01/12/2022, 22:05
General
-
Target
839b4baa551ca71753994e4bf879f58c425dacefe4d2689097bfe02eaee3921a.exe
-
Size
196KB
-
MD5
49a2d19637804a785b6ddf5cb6bb16ed
-
SHA1
3b6e79a8208c58a56a1586cf5477812e4a3b9aeb
-
SHA256
839b4baa551ca71753994e4bf879f58c425dacefe4d2689097bfe02eaee3921a
-
SHA512
8db861742a99e3d1169d7f8ef4710851154531bb4f62c44fb935582963f3f2276836146e7e2955041216a0f01d7b83fb99af3eebc73e8d0e6123362e5bd683af
-
SSDEEP
3072:WB7WtowMfN0ztRYR8u7ivSd82laHSmM7N795rj2EtUNmpKIQTZxqcW/:mitjMfyhRYb7iKG2laymo5JUN4+c
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
-
Modifies security service 2 TTPs 6 IoCs
-
Executes dropped EXE 2 IoCs
-
Registers COM server for autorun 1 TTPs 4 IoCs
-
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops desktop.ini file(s) 2 IoCs
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\839b4baa551ca71753994e4bf879f58c425dacefe4d2689097bfe02eaee3921a.exe"C:\Users\Admin\AppData\Local\Temp\839b4baa551ca71753994e4bf879f58c425dacefe4d2689097bfe02eaee3921a.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d13d54a87652ee79ea496d43aea4f85a
SHA120d166cb91b24d0c16fd309e3631afe50d196e6c
SHA2562e027a580256dffe0255651c083e547ad2485f568f46bba7336fd4ce5e8a5a51
SHA51297c3cabe13a81d11aad691913cf479f4c38904679bd3c6468f0098a70aaffd2848be76334785674c453ffa845fdadd407e1ae71968ab86937faa795ad23b0934
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
8KB
-
Filesize
204KB
-
Filesize
204KB