Analysis
-
max time kernel
169s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/12/2022, 02:37
General
-
Target
7d75b7874ebda81709fd06aade4c25a94edb785f7f396102d4a35deb895f8fab.exe
-
Size
245KB
-
MD5
138cec51bd5fef0a31f6a0d7a5e677b9
-
SHA1
d0aab7e3950018cd5f3f176db5b381d25adbe164
-
SHA256
7d75b7874ebda81709fd06aade4c25a94edb785f7f396102d4a35deb895f8fab
-
SHA512
14bf0c78eab7a98b7d7fad39f49097ecce325e62d3b0d1e47e0296e742c348c67091d93cb063276da751b382b6f72496a5fb874a5ebac6f37103ed3d4fbce492
-
SSDEEP
6144:mMWHbRh4N04G+U2cnJLaWVKhxQd91ShzXakv0h:zu4G4GlJLJKnw91SlXW
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d75b7874ebda81709fd06aade4c25a94edb785f7f396102d4a35deb895f8fab.exe"C:\Users\Admin\AppData\Local\Temp\7d75b7874ebda81709fd06aade4c25a94edb785f7f396102d4a35deb895f8fab.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
420KB
-
Filesize
252KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
252KB
-
Filesize
736KB