Analysis
-
max time kernel
226s -
max time network
311s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01-12-2022 04:23
General
-
Target
630a7a0ca81af99918fc6d9719c7ed6cfd9a059c6a979e3eb2eea3139c326ca9.exe
-
Size
165KB
-
MD5
7efff8398a8c54106dac725bcfb383df
-
SHA1
2ffd3b5412a590073f17be4fac0f5e28fbee8bf2
-
SHA256
630a7a0ca81af99918fc6d9719c7ed6cfd9a059c6a979e3eb2eea3139c326ca9
-
SHA512
7d3327ae76488c28ea823ae2c57f8146ceec0e4a230af52adf585de79b6b429cf1a8b44f4e068dee04a1d57de1eb3e2a32f1f52ed0a50a9abfdaad6efbc432ae
-
SSDEEP
3072:xWTBvKWLbGQPrGjAPCum9knrxarRPHwb2Bvt7MRLVSgFVgLuc/1FMgMK6c94B:ezXPyv+rxWXt7MRLgAVgqcgN
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
-
Modifies security service 2 TTPs 9 IoCs
-
Executes dropped EXE 2 IoCs
-
Registers COM server for autorun 1 TTPs 4 IoCs
-
Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\630a7a0ca81af99918fc6d9719c7ed6cfd9a059c6a979e3eb2eea3139c326ca9.exe"C:\Users\Admin\AppData\Local\Temp\630a7a0ca81af99918fc6d9719c7ed6cfd9a059c6a979e3eb2eea3139c326ca9.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD555bc2d35a452ceea3f51649e9cd3d607
SHA1a41dc9ae52b99772088c6b1af4fc26360b2e49bf
SHA256e41a640b6a2fd5fbcd4b5acbd0027128ab87305bd471f48229e406eb86916daf
SHA512b8b774842b58d439464a6263742039eefda7891692c2c586946df40d6aa49399bd8d624628d1f2764816829c8ae5315778a7ea13f6ad4e3c08958b6683a03438
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
8KB
-
Filesize
180KB
-
Filesize
116KB
-
Filesize
180KB
-
Filesize
116KB