Analysis
-
max time kernel
151s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01/12/2022, 22:36
General
-
Target
791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e.exe
-
Size
163KB
-
MD5
30dfe01b30835ef02bc7ed0c9d202470
-
SHA1
21a7fc89ee9f67e7a2a495463d80091a7e70bec2
-
SHA256
791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e
-
SHA512
1ff3aab19bf270bb3786267e725700f9dd48b04fa5beb8fd2f3f1b795b82ed0582797499b4f0347c2de6d85017909e5bcadb0e3dc3ef9f0eb5c0c30aabbfbc8c
-
SSDEEP
3072:CNvuPYzgSsgXHvbLXajMkfFkj+A57zBvg/w2xWE59b:mCEHHX6Mktw+I7zB6wY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Deletes itself 1 IoCs
-
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 15 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e.exe"C:\Users\Admin\AppData\Local\Temp\791a8293a1721b9ff1bb3cce59b9f7a755d2229f538697a48dac74937f17dd3e.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
144KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
144KB