Analysis
-
max time kernel
268s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01/12/2022, 09:13
General
-
Target
e5dc0714ef8c0716a2a061835166c442013fc5ebf7f36877f99d7666ab06bf98.exe
-
Size
191KB
-
MD5
a897bc781f689e479b7574511dd6618b
-
SHA1
331cf90a41c54f6f535cc4385dd80d8c5e55ea9a
-
SHA256
e5dc0714ef8c0716a2a061835166c442013fc5ebf7f36877f99d7666ab06bf98
-
SHA512
7ee02341db1c6f773882b8a2f10ed3115ac5729b558840b740445898eb942a0d8d046ccfb1a0a01c600a5396e20266022bca030163907464f7c63909cf3be5c9
-
SSDEEP
3072:KR2XtnAhaMwWQTYzjPouKFOhU8kQsphfYnO+lAOs4maj0wxbzgNINI53:BtCaMGyjgumr8fEqnoOsr7wxbzYINI53
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
-
Modifies security service 2 TTPs 11 IoCs
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\e5dc0714ef8c0716a2a061835166c442013fc5ebf7f36877f99d7666ab06bf98.exe"C:\Users\Admin\AppData\Local\Temp\e5dc0714ef8c0716a2a061835166c442013fc5ebf7f36877f99d7666ab06bf98.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d1dcd30234eb01abf4098cd948de7aab
SHA129d6df4d13e5838e0db03a4cb0fd733f3beaa177
SHA2566ff4abf3e471304d6ec8885c40faf9da946a311491781465bb7ebe695b4a09d1
SHA51291fa71b1780026bcd1b68703912c90190a3ac186b8731bee28428afd39469b5df1c9f56c5928a6e378964ceaaa56c7a0c801e7e62907aff65dc103869256c368
-
Filesize
44KB
-
Filesize
60KB
-
Filesize
44KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
212KB
-
Filesize
8KB
-
Filesize
212KB
-
Filesize
212KB