Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
05/12/2022, 06:25
General
-
Target
c5b6ee8f86f5fbdd64566a63becb0e61844f2aa91a6f9bb82a60c9d03314ab20.exe
-
Size
276KB
-
MD5
00ae07e7ab54ea8ca70a2d74db7d63c6
-
SHA1
d0737647dfffee7e6271e17e908eb67c6309f151
-
SHA256
c5b6ee8f86f5fbdd64566a63becb0e61844f2aa91a6f9bb82a60c9d03314ab20
-
SHA512
5b8871831bb173ce05888e9f28c48cde654a602d7d1bdc6ee90042a75bbce5fae86b715f726c304db1d34371154c59f04fa723b3c8b4cc4745b60ca28e25962c
-
SSDEEP
6144:IcD08VhiUJw46Xjhbg6xDyv2GALijX1Na/HZuk:IcD08VwUJ76Xjh0sFXiJk
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5b6ee8f86f5fbdd64566a63becb0e61844f2aa91a6f9bb82a60c9d03314ab20.exe"C:\Users\Admin\AppData\Local\Temp\c5b6ee8f86f5fbdd64566a63becb0e61844f2aa91a6f9bb82a60c9d03314ab20.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
260KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
788KB
-
Filesize
788KB