Analysis
-
max time kernel
167s -
max time network
174s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01/12/2022, 09:19
General
-
Target
df387bd1d2d554dd0e44d283de11c67498f7f7ceae908bbb59175afea575b3bf.exe
-
Size
246KB
-
MD5
c7d9058fdbc692812487b955d143afdf
-
SHA1
71a523c4b60e1da96240ab3fa666924bc78a7ad5
-
SHA256
df387bd1d2d554dd0e44d283de11c67498f7f7ceae908bbb59175afea575b3bf
-
SHA512
8ead623e139ecaf497a4bb7fd17c35ecb4ef84d97e68a4a6edd2d8262ef28547778e00fb4eead7bb4a513487044a055b5b1c0eeb71a6c84049e706bedfb7ab75
-
SSDEEP
6144:ih/W35vSV6Bui97AdB+xgf7Oy7tJlL3aVXGT2p3wZWv:JJv6i976HfN7rl2VXPp3E
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df387bd1d2d554dd0e44d283de11c67498f7f7ceae908bbb59175afea575b3bf.exe"C:\Users\Admin\AppData\Local\Temp\df387bd1d2d554dd0e44d283de11c67498f7f7ceae908bbb59175afea575b3bf.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
-
Filesize
8KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
472KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
420KB
-
Filesize
472KB
-
Filesize
736KB