Analysis
-
max time kernel
172s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
06-12-2022 15:44
General
-
Target
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe
-
Size
376KB
-
MD5
708c4d11c0e0c68e3694d527fc86951a
-
SHA1
2cc880b2265dbca3b57308a747f654c1c110fd88
-
SHA256
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d
-
SHA512
798f086a9cc6564f50a9c6bca860c035657f77296da3b1475368dd6797f9ba8b278df50829701c6e34d58c688bb81fe4fea51949c88ed987792ea805658042bb
-
SSDEEP
6144:DpZbPT3pqObP5F9uqJjLnGRwjG9XPR2rIttqg6EdguFA7fP8dqufOy/:D7rT3pFRF9TJjL0wjG9fR2Mjj6eHQVuN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\fP01605CfJlD01605\fP01605CfJlD01605.exe"C:\ProgramData\fP01605CfJlD01605\fP01605CfJlD01605.exe" "C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5586017059a064b24df118ff703d34ddf
SHA10799c579da41fd92a76e9b829c56063a16752588
SHA2563ddb74f4c8d11391776a3ba33bc0392ddec1e4d7fe30fea66fd5471273df6f5e
SHA5122146d16680046305cc477eb84752769f28f1e5a7c69b9236f8202dafd84577fc734deeda7c75660a566528fd96e971d58e9ee807a3b03f5ffd9264172c4f7fe4
-
Filesize
376KB
MD5586017059a064b24df118ff703d34ddf
SHA10799c579da41fd92a76e9b829c56063a16752588
SHA2563ddb74f4c8d11391776a3ba33bc0392ddec1e4d7fe30fea66fd5471273df6f5e
SHA5122146d16680046305cc477eb84752769f28f1e5a7c69b9236f8202dafd84577fc734deeda7c75660a566528fd96e971d58e9ee807a3b03f5ffd9264172c4f7fe4
-
Filesize
376KB
MD5586017059a064b24df118ff703d34ddf
SHA10799c579da41fd92a76e9b829c56063a16752588
SHA2563ddb74f4c8d11391776a3ba33bc0392ddec1e4d7fe30fea66fd5471273df6f5e
SHA5122146d16680046305cc477eb84752769f28f1e5a7c69b9236f8202dafd84577fc734deeda7c75660a566528fd96e971d58e9ee807a3b03f5ffd9264172c4f7fe4
-
Filesize
376KB
MD5586017059a064b24df118ff703d34ddf
SHA10799c579da41fd92a76e9b829c56063a16752588
SHA2563ddb74f4c8d11391776a3ba33bc0392ddec1e4d7fe30fea66fd5471273df6f5e
SHA5122146d16680046305cc477eb84752769f28f1e5a7c69b9236f8202dafd84577fc734deeda7c75660a566528fd96e971d58e9ee807a3b03f5ffd9264172c4f7fe4
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
780KB
-
-
Filesize
780KB