Analysis

  • max time kernel
    150s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 15:50

General

  • Target

    fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe

  • Size

    1.9MB

  • MD5

    ad9eac0ed90dd646bcd2ae091d0e19c3

  • SHA1

    5830ce2b1646b435b6fa800815bb01e42ce7343b

  • SHA256

    fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb

  • SHA512

    8eba72f1649f8018ea310663d93199e7d5452c3e42dd3a3a9d0ecb960d32ed67291f7c2ea8ce12a03c686fcc1b47d7af8a0252b7b9a870fc6879d57c1b542f24

  • SSDEEP

    49152:h7zDNYT8s1BkkT1lWnh5eIao1nEj5d2qA/5gfH7J/YnWL:9+8uBkGWnKoNEj5RA/YpYWL

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe
    "C:\Users\Admin\AppData\Local\Temp\fd06f81f501feca9ade42c4cbe0bdc83104c3512fdb5c5a329de127516c366bb.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1352

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1352-54-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-57-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-56-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-55-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-58-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-59-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-62-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-61-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-60-0x0000000075B51000-0x0000000075B53000-memory.dmp

          Filesize

          8KB

        • memory/1352-63-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-64-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-65-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-67-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-66-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-68-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-69-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-73-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-74-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-75-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-72-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-71-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-70-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-76-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-77-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-78-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-79-0x00000000004D1000-0x00000000004D3A00-memory.dmp

          Filesize

          10KB

        • memory/1352-80-0x0000000000400000-0x0000000001673000-memory.dmp

          Filesize

          18.4MB

        • memory/1352-81-0x000000007EF50000-0x000000007EFAC000-memory.dmp

          Filesize

          368KB

        • memory/1352-82-0x0000000000400000-0x0000000001673000-memory.dmp

          Filesize

          18.4MB