Analysis
-
max time kernel
78s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
05/12/2022, 11:21
General
-
Target
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe
-
Size
243KB
-
MD5
a2e621cb7630d1eb95839242b92d92b5
-
SHA1
6afdf66253e6cfad74ec6c308e848a9434afe490
-
SHA256
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
-
SHA512
fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
SSDEEP
6144:+PhHaosPOvb27I91wkpzPQ/d45JCxlZd4izCW5rRhg26:+PhgPOvb27SJm45OOizCW5N6
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 17 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe"C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\sbu.exe"C:\Users\Admin\AppData\Local\sbu.exe" -gav C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe2⤵
- Executes dropped EXE
- Deletes itself
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
8KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
20KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
900KB
-
Filesize
8KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
20KB
-
Filesize
964KB
-
Filesize
964KB
-
Filesize
900KB