Analysis
-
max time kernel
33s -
max time network
37s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03/12/2022, 13:29
General
-
Target
fc99c20a928d0a54a83a10171c4634a2f0ae0950979d8684fdeeda7ac9eb80a3.exe
-
Size
85KB
-
MD5
70c3bdfa9308a5c6445b759319753064
-
SHA1
5eb25ca76188aaf9e002987444bd7465b025ba97
-
SHA256
fc99c20a928d0a54a83a10171c4634a2f0ae0950979d8684fdeeda7ac9eb80a3
-
SHA512
4be2ae86384696b6d5087c7e3582f33a3099fb3fa6e6f170bee695ee7f97ad74254754fac860511db1431ea90f03fa3b122e34d6bca72327f33468d45fffda48
-
SSDEEP
1536:wmctZSIMMmynkmZ80UE/K2oey5bZUU+hP9Y0Mfds/axVdfgeMF4nDH4hG3:wmMZSIXu5EeVUlhcceLgVF4DY
Malware Config
Signatures
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc99c20a928d0a54a83a10171c4634a2f0ae0950979d8684fdeeda7ac9eb80a3.exe"C:\Users\Admin\AppData\Local\Temp\fc99c20a928d0a54a83a10171c4634a2f0ae0950979d8684fdeeda7ac9eb80a3.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\FC99C2~1.EXE > nul2⤵
- Deletes itself
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD585ea0f36528e0451ad50f9ffc889130b
SHA111e655e7ceea5e3e41571271c75979b7515943e4
SHA256de226209a888f010c36c74b551b312f60fbf45414e93c58370f9d550a393410f
SHA5123fb415333db403781f5feba5d5054713c55d304ef475cd7a4a4c8d59a0358175fefe023becb171732d8cacf6b0fa002855bcac4e109a1adb44abecc4a0e83d88
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
188KB