Analysis
-
max time kernel
202s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04/12/2022, 12:30
General
-
Target
d708824a5e77475930de80cc16603b7fb47f5b58c89f74c51d6ca05812c95e4c.exe
-
Size
399KB
-
MD5
02a5884f0fa7f8a170e83620e4a0ca9b
-
SHA1
098f037fda7b9a5f45931e597b34a989bda31466
-
SHA256
d708824a5e77475930de80cc16603b7fb47f5b58c89f74c51d6ca05812c95e4c
-
SHA512
8569bada39c4aebf9e3cdbd4705bf3e96ca5f345518a6307fabb2ba71beed837f041805e00138db0ec4a51d87d19ad706c5fd50c7f7261bff4ce1657e712c963
-
SSDEEP
12288:2L2iSCA5m+jd7P69jTeJ5CMt30BXIOY2jqjyybzX4:Y+mGJ51E1IOY+qZbr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d708824a5e77475930de80cc16603b7fb47f5b58c89f74c51d6ca05812c95e4c.exe"C:\Users\Admin\AppData\Local\Temp\d708824a5e77475930de80cc16603b7fb47f5b58c89f74c51d6ca05812c95e4c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fHhAjEa09200\fHhAjEa09200.exe"C:\ProgramData\fHhAjEa09200\fHhAjEa09200.exe" "C:\Users\Admin\AppData\Local\Temp\d708824a5e77475930de80cc16603b7fb47f5b58c89f74c51d6ca05812c95e4c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
399KB
MD5009b3c6172a37b3c33c3204ea8f66ccf
SHA176a823852140c4bb85a6c51e3c2b59907e2481d5
SHA256de5b1db5ea8ad5cbce14b49ca290c8913cddd985bb3085e2735b6fe9582cd6a8
SHA512b0f95c98d716bb7cd8c6e041acc2ff1f9dd6c4dd49a502e6f657706505c0c5d3ba748d24dd94b8662b29b7b54d5cb098c226986bd15d2e89154fa6c606b5d5b5
-
Filesize
399KB
MD5009b3c6172a37b3c33c3204ea8f66ccf
SHA176a823852140c4bb85a6c51e3c2b59907e2481d5
SHA256de5b1db5ea8ad5cbce14b49ca290c8913cddd985bb3085e2735b6fe9582cd6a8
SHA512b0f95c98d716bb7cd8c6e041acc2ff1f9dd6c4dd49a502e6f657706505c0c5d3ba748d24dd94b8662b29b7b54d5cb098c226986bd15d2e89154fa6c606b5d5b5
-
Filesize
399KB
MD5009b3c6172a37b3c33c3204ea8f66ccf
SHA176a823852140c4bb85a6c51e3c2b59907e2481d5
SHA256de5b1db5ea8ad5cbce14b49ca290c8913cddd985bb3085e2735b6fe9582cd6a8
SHA512b0f95c98d716bb7cd8c6e041acc2ff1f9dd6c4dd49a502e6f657706505c0c5d3ba748d24dd94b8662b29b7b54d5cb098c226986bd15d2e89154fa6c606b5d5b5
-
Filesize
399KB
MD5009b3c6172a37b3c33c3204ea8f66ccf
SHA176a823852140c4bb85a6c51e3c2b59907e2481d5
SHA256de5b1db5ea8ad5cbce14b49ca290c8913cddd985bb3085e2735b6fe9582cd6a8
SHA512b0f95c98d716bb7cd8c6e041acc2ff1f9dd6c4dd49a502e6f657706505c0c5d3ba748d24dd94b8662b29b7b54d5cb098c226986bd15d2e89154fa6c606b5d5b5
-
Filesize
8KB
-
Filesize
252KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
252KB
-
Filesize
728KB
-
Filesize
252KB
-
Filesize
728KB
-
Filesize
252KB