Analysis
-
max time kernel
71s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
01-12-2022 19:13
General
-
Target
b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13.exe
-
Size
348KB
-
MD5
47a0b307f91153244e04993f9b0f860c
-
SHA1
5046525f6eb127b907de97a70e106506a1772d74
-
SHA256
b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13
-
SHA512
f1b23dc60d28c31a622135f872a1580a89cab1e729656c2f9cb69b314feb3bd9a123ef9cf0bf0c73d30e4ec2646876bb8a6d51bd7d1cfe74ad39c92bd5e3647c
-
SSDEEP
6144:Q5PjeSKCbi8H8WrT3+ANDFpbTTNFGLi9oH2VS3dFW4tc8QztFBkg:Q1eTC+qRv3+ABTTNEiW6S3dJe/3Bj
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13.exe"C:\Users\Admin\AppData\Local\Temp\b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\vdv.exe"C:\Users\Admin\AppData\Local\vdv.exe" -gav C:\Users\Admin\AppData\Local\Temp\b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13.exe2⤵
- Executes dropped EXE
- Deletes itself
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5b01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
348KB
MD547a0b307f91153244e04993f9b0f860c
SHA15046525f6eb127b907de97a70e106506a1772d74
SHA256b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13
SHA512f1b23dc60d28c31a622135f872a1580a89cab1e729656c2f9cb69b314feb3bd9a123ef9cf0bf0c73d30e4ec2646876bb8a6d51bd7d1cfe74ad39c92bd5e3647c
-
Filesize
348KB
MD547a0b307f91153244e04993f9b0f860c
SHA15046525f6eb127b907de97a70e106506a1772d74
SHA256b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13
SHA512f1b23dc60d28c31a622135f872a1580a89cab1e729656c2f9cb69b314feb3bd9a123ef9cf0bf0c73d30e4ec2646876bb8a6d51bd7d1cfe74ad39c92bd5e3647c
-
Filesize
348KB
MD547a0b307f91153244e04993f9b0f860c
SHA15046525f6eb127b907de97a70e106506a1772d74
SHA256b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13
SHA512f1b23dc60d28c31a622135f872a1580a89cab1e729656c2f9cb69b314feb3bd9a123ef9cf0bf0c73d30e4ec2646876bb8a6d51bd7d1cfe74ad39c92bd5e3647c
-
Filesize
348KB
MD547a0b307f91153244e04993f9b0f860c
SHA15046525f6eb127b907de97a70e106506a1772d74
SHA256b31376da63c002359bc1bbc94795f36cc6f0a0a1ecee0c2f0f735722267ede13
SHA512f1b23dc60d28c31a622135f872a1580a89cab1e729656c2f9cb69b314feb3bd9a123ef9cf0bf0c73d30e4ec2646876bb8a6d51bd7d1cfe74ad39c92bd5e3647c
-
Filesize
8KB
-
Filesize
900KB
-
Filesize
960KB
-
Filesize
900KB
-
Filesize
24KB
-
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
900KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
24KB
-
Filesize
960KB
-
Filesize
24KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
900KB