Analysis

  • max time kernel
    139s
  • max time network
    102s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 10:58

General

  • Target

    9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91.exe

  • Size

    437KB

  • MD5

    4bd18e3e3943f695a79f866ca59d98fb

  • SHA1

    d625aafb3c6abbf5fd0cc9e45c581d3190e82d7c

  • SHA256

    9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91

  • SHA512

    88fb6f0f3c2b13a64950ba3e7ad4b0de990005c2b10165020660024eef7094300c11e6489739b95e6cfede5afbe50f9d7988d28a11efe332554aa65f7aef10ef

  • SSDEEP

    12288:v4CPxosAia9i8aQFD+wMLYP0Wd7vXezx91rXTdsY347bysR:v4CPxXpxhgD+wMLLO7fw9NRd47esR

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91.exe
    "C:\Users\Admin\AppData\Local\Temp\9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:364
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Windows\uninstal.bat
      2⤵
      • Deletes itself
      PID:1940
  • C:\Windows\dny.exe
    C:\Windows\dny.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\dny.exe

    Filesize

    437KB

    MD5

    4bd18e3e3943f695a79f866ca59d98fb

    SHA1

    d625aafb3c6abbf5fd0cc9e45c581d3190e82d7c

    SHA256

    9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91

    SHA512

    88fb6f0f3c2b13a64950ba3e7ad4b0de990005c2b10165020660024eef7094300c11e6489739b95e6cfede5afbe50f9d7988d28a11efe332554aa65f7aef10ef

  • C:\Windows\dny.exe

    Filesize

    437KB

    MD5

    4bd18e3e3943f695a79f866ca59d98fb

    SHA1

    d625aafb3c6abbf5fd0cc9e45c581d3190e82d7c

    SHA256

    9e3320db45eca5090fde2a404289c497a228725823810454fa8be46a27c40b91

    SHA512

    88fb6f0f3c2b13a64950ba3e7ad4b0de990005c2b10165020660024eef7094300c11e6489739b95e6cfede5afbe50f9d7988d28a11efe332554aa65f7aef10ef

  • C:\Windows\uninstal.bat

    Filesize

    254B

    MD5

    4bfff06a01bbaa9fc21f8c4150f35567

    SHA1

    5c3d99e8dc9530b3aa795098c0d7ff2e5fbaf3a8

    SHA256

    de6c95ca20eeca555193945601a6f0071f1f744fde933b7513fc81a0bb295802

    SHA512

    e49171be107f3c5c695b9eb336acbfafb257441ad1d60caa1affd230a32cb92734878d404f2262dbd018ba1ab061a38424129fc886333f56c45fc0cfb45df1fb

  • memory/364-54-0x0000000000400000-0x0000000000A5F000-memory.dmp

    Filesize

    6.4MB

  • memory/364-55-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB

  • memory/364-56-0x0000000000400000-0x0000000000A5F000-memory.dmp

    Filesize

    6.4MB

  • memory/364-62-0x0000000000400000-0x0000000000A5F000-memory.dmp

    Filesize

    6.4MB

  • memory/1708-60-0x0000000000400000-0x0000000000A5F000-memory.dmp

    Filesize

    6.4MB

  • memory/1708-65-0x0000000000400000-0x0000000000A5F000-memory.dmp

    Filesize

    6.4MB