Analysis
-
max time kernel
179s -
max time network
173s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
02-12-2022 23:21
General
-
Target
d12bb05c7c81580da6173250294b439d3b8032f6fd3462171af865d0fdd3243d.exe
-
Size
227KB
-
MD5
a4f4e83d338b668b3e5de2a227619e32
-
SHA1
9f720978a5630b7bf47bf79bc40baea41de84c4f
-
SHA256
d12bb05c7c81580da6173250294b439d3b8032f6fd3462171af865d0fdd3243d
-
SHA512
2104c31040e5c661673c478afab474572a864b402ccca762ec17d490220a5200f976c86d97470b231b36f25452c8179d8cc1264dc9f25b87a1c9a4109e3ac813
-
SSDEEP
3072:jbQi390ezV3Q7RcaDryukKLeC1TkGNmCjxqX/fI/x0s29ygBqQkmDRK:jR39JsXryukHCRXmCjxqX3LZBOE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d12bb05c7c81580da6173250294b439d3b8032f6fd3462171af865d0fdd3243d.exe"C:\Users\Admin\AppData\Local\Temp\d12bb05c7c81580da6173250294b439d3b8032f6fd3462171af865d0fdd3243d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\Ghozoa.exeC:\Windows\Ghozoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
227KB
MD5a4f4e83d338b668b3e5de2a227619e32
SHA19f720978a5630b7bf47bf79bc40baea41de84c4f
SHA256d12bb05c7c81580da6173250294b439d3b8032f6fd3462171af865d0fdd3243d
SHA5122104c31040e5c661673c478afab474572a864b402ccca762ec17d490220a5200f976c86d97470b231b36f25452c8179d8cc1264dc9f25b87a1c9a4109e3ac813
-
Filesize
408B
MD511cb34bde558073443dffb5072f8925d
SHA1962e770b1ea500fc40e38d24b83d50901c2b4c96
SHA25647bdb5ec6c8ca64c414b2e3e0510c362c100ebd395b8aa29a3fd9974b87b567f
SHA51299c4cd4ccfa9f49f4632a5d9b215998086f0ee8c3c190be3a06dd9b578863f7e0c119d8a4526ac2fe450eb30e6a5a4549631587d6d28a173f08eed74fbe07c28
-
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
8KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB