Analysis
-
max time kernel
78s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03/12/2022, 08:35
General
-
Target
ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe
-
Size
102KB
-
MD5
50532a6e6faa001aaaa1c8067ea81910
-
SHA1
f0351bd37acd77fef1fb9eed239a4e52e0d01b2a
-
SHA256
ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650
-
SHA512
24d765d0dd6374370de5f1b7b693f18b6bcd8b5190c814a2eff3b3393e8c625ef9b7a0cd2107f4b6dd48c99d204b80e7663d45b3126adffb03d39c3aaa2abe15
-
SSDEEP
3072:ka4GvOcgSzBKMsxm4+oo+3Wq1pxOYjDvpp:kxcrq8YjVp
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe"C:\Users\Admin\AppData\Local\Temp\ed91e67b7ac14eb706795925e33102926a178b84985ad7b2606b4afe73f4e650.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
-
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
-
Filesize
32KB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
100KB
-
Filesize
100KB