Overview

overview

5

Static

static

f7f1b91ca7...7a.exe

windows7-x64

5

f7f1b91ca7...7a.exe

windows10-2004-x64

5

Analysis

  • max time kernel
    104s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2022, 11:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f7f1b91ca77b90ce854bf29e36879eafec51789e3853411d9dd3fc6bdf9ca57a.exe

  • Size

    30KB

  • MD5

    177c9b2ac3983f978c9f558327df64b4

  • SHA1

    4b74faf2d5342c1821c6ceaa095ec10edf379a50

  • SHA256

    f7f1b91ca77b90ce854bf29e36879eafec51789e3853411d9dd3fc6bdf9ca57a

  • SHA512

    816d8b0e977bd589bdf6513053d48869f64f880283e99a3f438b67d3d8ae0afe4ef59b3a285e45f0b4717e77acd0e17d8db04b34893ecf222e5a5a3456e70e31

  • SSDEEP

    384:pf+RHIl4rQ/0ZJhGc4zGsrcXE96cYJLW7HbP6jF:pf+K0ZPGc4qGEEsRLobPmF

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7f1b91ca77b90ce854bf29e36879eafec51789e3853411d9dd3fc6bdf9ca57a.exe
    "C:\Users\Admin\AppData\Local\Temp\f7f1b91ca77b90ce854bf29e36879eafec51789e3853411d9dd3fc6bdf9ca57a.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\SysWOW64\mmc.exe
      mmc c:\windows\system32\gpedit.msc
      2⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3684
      • C:\Windows\system32\mmc.exe
        "c:\windows\system32\gpedit.msc" c:\windows\system32\gpedit.msc
        3⤵
        • Drops file in System32 directory
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:3216

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3216-137-0x00007FFFCB850000-0x00007FFFCC311000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3216-138-0x00007FFFCB850000-0x00007FFFCC311000-memory.dmp

          Filesize

          10.8MB

          Download