Analysis
-
max time kernel
207s -
max time network
217s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
03-12-2022 21:01
General
-
Target
b005736998f5832a393c4cad02e33965059b62b002cebba970ab3bfb26301eb9.exe
-
Size
117KB
-
MD5
0eb1121b87a4608c6ef51119411439ac
-
SHA1
26715fe0ce01df6f46a7e2e13b4249419d3d238f
-
SHA256
b005736998f5832a393c4cad02e33965059b62b002cebba970ab3bfb26301eb9
-
SHA512
b470bb68bb0a72bd995cfe82e3972af107681877b0c05d1a45eb27c965ea7e5a83e6db68a82b4515f160e83b5a06c833660794176833da3989fdaad9ec64dbfb
-
SSDEEP
3072:Qxvmpm2yKept6op+s+5fTRaqym0WkJificeFaE:IKep1Iss4qGR0fipFa
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b005736998f5832a393c4cad02e33965059b62b002cebba970ab3bfb26301eb9.exe"C:\Users\Admin\AppData\Local\Temp\b005736998f5832a393c4cad02e33965059b62b002cebba970ab3bfb26301eb9.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Czowoa.exeC:\Windows\Czowoa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD50eb1121b87a4608c6ef51119411439ac
SHA126715fe0ce01df6f46a7e2e13b4249419d3d238f
SHA256b005736998f5832a393c4cad02e33965059b62b002cebba970ab3bfb26301eb9
SHA512b470bb68bb0a72bd995cfe82e3972af107681877b0c05d1a45eb27c965ea7e5a83e6db68a82b4515f160e83b5a06c833660794176833da3989fdaad9ec64dbfb
-
Filesize
408B
MD517275bcbbc918744f8a04e04c64afdca
SHA1148dcb1a968380ccc3e45e7d204bfd24e2bf02d1
SHA25614d570ee50cef3210649997d45c7af9f65bb48a34acbc524aeff172dd3acd36f
SHA5126b6f7e49adffe8aad71e8c5fddd6efea98d9a9b718f12c403c7e3b863345781da676a83bc8026e6d5a0cc3c7fabff74ec2a7cc9fe51186c75a6e77cfaee95f24
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
264KB
-
Filesize
264KB
-
Filesize
264KB
-
-
Filesize
264KB
-
Filesize
264KB