Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
02/12/2022, 21:15
General
-
Target
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe
-
Size
384KB
-
MD5
961ed7877734896802618112caa231b7
-
SHA1
2af29cbc48dfcc433a43ecd1e864c0e8b0b88928
-
SHA256
d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14
-
SHA512
d494e9be3afc75b3b3672feeb593e4fe59c2e3c72621ce4b8a2990e2ee8854276e3cdfc0749174af237a60c3b5007b4096c83f68c2132fe90b2fc0e78ca7a6d3
-
SSDEEP
6144:lmAN2VXVN29dppKp91YbR6IydCrBbif/62N0TXRALU:lmBVXVMnop91Y90cif5NQRALU
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fF21703HpOeM21703\fF21703HpOeM21703.exe"C:\ProgramData\fF21703HpOeM21703\fF21703HpOeM21703.exe" "C:\Users\Admin\AppData\Local\Temp\d22724d841050fb9e5d759fce864c77eb6249173f4b915bb612683782cdaeb14.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
384KB
MD51f9d8d7001bc203b07c41b18c05f3329
SHA1f5c3cf4c8a1aa40c987af8bcef2a9f06a0f4e83c
SHA2567d88ab8ae29d8f32a7cf1e49558943bcf1f347139c2903cda9272e835cae0dc9
SHA5124d3cf511f6da5016d0f63ceb91a3cc3ad5f80b78c16b00471e34a5145b933c54923b358940163705df49e828fd65db03270ef226a71e0dab5df277eb8eb33683
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB