Analysis
-
max time kernel
148s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03/12/2022, 12:03
General
-
Target
df5ab223f34a29c57df0b260bfdefe25cc01bc75321c6e93269ef2c1aee38b88.exe
-
Size
259KB
-
MD5
10bb77f4347a8180f3069ec4a1d3bb00
-
SHA1
77663841912b9ecdefb187acb04fb1faf09c05f8
-
SHA256
df5ab223f34a29c57df0b260bfdefe25cc01bc75321c6e93269ef2c1aee38b88
-
SHA512
fe5188ea3f4be4ccafb6f67246deacf6b60dcc1d34f0dab82d23737913ac888a42717ede5cc1c1e69dea18edc5894b57c64feb3829f56418daae36efaf732b71
-
SSDEEP
6144:Wqkpl9HX8DqrItDpSuXgUJhS19Guxox5F7OyEPk/aEMBeqrNVwPm7ygSTD:WlD38Dqr6ZvJh2Gu8myckJ0eqhWrfTD
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df5ab223f34a29c57df0b260bfdefe25cc01bc75321c6e93269ef2c1aee38b88.exe"C:\Users\Admin\AppData\Local\Temp\df5ab223f34a29c57df0b260bfdefe25cc01bc75321c6e93269ef2c1aee38b88.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
3.0MB
-
Filesize
356KB
-
Filesize
3.0MB
-
Filesize
356KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
736KB
-
Filesize
736KB