Analysis
-
max time kernel
153s -
max time network
58s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
03/12/2022, 05:12
General
-
Target
c7fc42b14b4086d1bb74e315c694f512943528fb34e7607dbc529ce7bf79fc7f.exe
-
Size
233KB
-
MD5
4cd8471d4b51c16727560afa50d57359
-
SHA1
ca34cad2e2052c696844d05422bb4e980b1d691a
-
SHA256
c7fc42b14b4086d1bb74e315c694f512943528fb34e7607dbc529ce7bf79fc7f
-
SHA512
a941a78c9464f473c63e6227de304d283007b698938f527200d80fc90317d96352502736d9ba62fe384bba2a31c39c71c272e9fdd4c8ee5d558c450e2baec990
-
SSDEEP
6144:DhczSK0xst01yWrWfZFykIn/dTTl+nqQp6SCDNYnrHb:+zpm1ZSfZFWVQcSfnDb
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 26 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7fc42b14b4086d1bb74e315c694f512943528fb34e7607dbc529ce7bf79fc7f.exe"C:\Users\Admin\AppData\Local\Temp\c7fc42b14b4086d1bb74e315c694f512943528fb34e7607dbc529ce7bf79fc7f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\igo.exe"C:\Users\Admin\AppData\Local\igo.exe" -gav C:\Users\Admin\AppData\Local\Temp\c7fc42b14b4086d1bb74e315c694f512943528fb34e7607dbc529ce7bf79fc7f.exe2⤵
- Executes dropped EXE
- Deletes itself
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4801⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233KB
MD5effa6b8eec2d5e6e83aa6ee31f422b0e
SHA17d82ec57980c855810462ba9e9b3b6ec400f8829
SHA256613ce5914ab693be064b13cdb2445bfb16249bbac9e63c12e500dd2450230869
SHA51211529a39d034564b57526755518db43a288dc511455c97e550a31a006f5b1a4b14b36af6d8d4d15c67478a44a11bb7be75063226706c25bf440e1874f673e574
-
Filesize
233KB
MD5effa6b8eec2d5e6e83aa6ee31f422b0e
SHA17d82ec57980c855810462ba9e9b3b6ec400f8829
SHA256613ce5914ab693be064b13cdb2445bfb16249bbac9e63c12e500dd2450230869
SHA51211529a39d034564b57526755518db43a288dc511455c97e550a31a006f5b1a4b14b36af6d8d4d15c67478a44a11bb7be75063226706c25bf440e1874f673e574
-
Filesize
233KB
MD5effa6b8eec2d5e6e83aa6ee31f422b0e
SHA17d82ec57980c855810462ba9e9b3b6ec400f8829
SHA256613ce5914ab693be064b13cdb2445bfb16249bbac9e63c12e500dd2450230869
SHA51211529a39d034564b57526755518db43a288dc511455c97e550a31a006f5b1a4b14b36af6d8d4d15c67478a44a11bb7be75063226706c25bf440e1874f673e574
-
Filesize
233KB
MD5effa6b8eec2d5e6e83aa6ee31f422b0e
SHA17d82ec57980c855810462ba9e9b3b6ec400f8829
SHA256613ce5914ab693be064b13cdb2445bfb16249bbac9e63c12e500dd2450230869
SHA51211529a39d034564b57526755518db43a288dc511455c97e550a31a006f5b1a4b14b36af6d8d4d15c67478a44a11bb7be75063226706c25bf440e1874f673e574
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
8KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
20KB
-
Filesize
900KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
20KB
-
Filesize
964KB
-
Filesize
900KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
8KB
-
Filesize
64KB