Analysis
-
max time kernel
153s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01-12-2022 04:21
General
-
Target
63581f0ac0a7f0333fee04aae7c8c8625538e1721802e93e8efc383f706fa66d.exe
-
Size
268KB
-
MD5
7eef384f4ab4b748d282db914fab57dc
-
SHA1
207dc0a0fef4baf2ac052a412e8218f981752ee7
-
SHA256
63581f0ac0a7f0333fee04aae7c8c8625538e1721802e93e8efc383f706fa66d
-
SHA512
5153fb6a1fa9ad96c8bb1c4fd7832e1251d6dc9bcca50022785f84cbfa508eb2e2b387afa68922a72e422b18e27b9b019a38bfad2506b1d42e39e38ab349e10c
-
SSDEEP
6144:MRkn+alqMqDoV0L29KQWFte1RfUuSDe+ArH:MRg+allJ0LcKNyR3SM
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63581f0ac0a7f0333fee04aae7c8c8625538e1721802e93e8efc383f706fa66d.exe"C:\Users\Admin\AppData\Local\Temp\63581f0ac0a7f0333fee04aae7c8c8625538e1721802e93e8efc383f706fa66d.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
412KB
-
Filesize
1.5MB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB