Analysis

  • max time kernel
    191s
  • max time network
    213s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-12-2022 03:16

General

  • Target

    7664d3b2b48c3af986f6a184f42988e267beb3e5cbc99562f9228ac18ba74051.exe

  • Size

    289KB

  • MD5

    7c5076f4818ad83b85c386d14a10a894

  • SHA1

    506aaae1de0316b8b20b94905f35a582ef659465

  • SHA256

    7664d3b2b48c3af986f6a184f42988e267beb3e5cbc99562f9228ac18ba74051

  • SHA512

    0a1d4a9a40af1b25db0ff643cc271e1dd0edb07076fa166b20c60413bde2976fa4c83fc9048de60c60d47ba222f38c0c1e1665fd81367b862bead270331def80

  • SSDEEP

    6144:4WqA/eRFp0yN90QE6KntvLfggDsMLDwP:R/eay904+xLfggDFDwP

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7664d3b2b48c3af986f6a184f42988e267beb3e5cbc99562f9228ac18ba74051.exe
    "C:\Users\Admin\AppData\Local\Temp\7664d3b2b48c3af986f6a184f42988e267beb3e5cbc99562f9228ac18ba74051.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1532
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Explorer.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Explorer.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:4376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TRADEH~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TRADEH~1.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1336

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Explorer.exe

    Filesize

    165KB

    MD5

    b0edea124678797b44fed1538f11ca24

    SHA1

    4c5bbc2f697db486257eaba821ade6839e4919f2

    SHA256

    26360b2600590cdedb3f1f187d164ebff66ba778d9109bdddc41cf3ce55d262c

    SHA512

    aac67d35a0f9a038f11a70f8e77723af03696107e9d1d2dca07a00a87e0ff6b271a0e01f8b6c33e739ca3ef49efae4affc557ad0ebcc4bad5fda3d3d752e34ad

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Explorer.exe

    Filesize

    165KB

    MD5

    b0edea124678797b44fed1538f11ca24

    SHA1

    4c5bbc2f697db486257eaba821ade6839e4919f2

    SHA256

    26360b2600590cdedb3f1f187d164ebff66ba778d9109bdddc41cf3ce55d262c

    SHA512

    aac67d35a0f9a038f11a70f8e77723af03696107e9d1d2dca07a00a87e0ff6b271a0e01f8b6c33e739ca3ef49efae4affc557ad0ebcc4bad5fda3d3d752e34ad

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TRADEH~1.EXE

    Filesize

    132KB

    MD5

    0d865f10d62629b3770236c44ed5b550

    SHA1

    9b811bde849a849531949b326459b8f21f67b5c9

    SHA256

    88ae7fcedc0d8bd1ced63a5757c31823843c02b4eaf7ae2b664f0236b5f579b0

    SHA512

    f95f8e4e5e108ea15d01bf62c3fedf9ddfb957bb594cb4f337bdaa858765973c24accbb4c039ed44ddd2042349d9b43fde681e975d63f56cbe66691f9159c900

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TRADEH~1.EXE

    Filesize

    132KB

    MD5

    0d865f10d62629b3770236c44ed5b550

    SHA1

    9b811bde849a849531949b326459b8f21f67b5c9

    SHA256

    88ae7fcedc0d8bd1ced63a5757c31823843c02b4eaf7ae2b664f0236b5f579b0

    SHA512

    f95f8e4e5e108ea15d01bf62c3fedf9ddfb957bb594cb4f337bdaa858765973c24accbb4c039ed44ddd2042349d9b43fde681e975d63f56cbe66691f9159c900