Analysis
-
max time kernel
195s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06-12-2022 18:52
General
-
Target
cf26a2286e3c6e3af6ff851778115d8b43b40aacecbf34ea17a4be49b4101dc8.exe
-
Size
33KB
-
MD5
1f15706411c0db2c722da2f9d067e040
-
SHA1
312aaedc7876b5198a3994759e24aba2bb828039
-
SHA256
cf26a2286e3c6e3af6ff851778115d8b43b40aacecbf34ea17a4be49b4101dc8
-
SHA512
54415a4f70f9e79f7b6b739201f1762cbe17e627b82c687217a02f9676b4b09b0ec8b8c4f12d3a27a0e65a06f8ad017cebb6f190ff0fd3b8e84b06747ef72346
-
SSDEEP
768:v7w4j2r+0akemBu67GAVS+eULg6RPdmua7iqalEW:vs4jphrmLnVSOk6hdF2QlEW
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 2 TTPs 4 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf26a2286e3c6e3af6ff851778115d8b43b40aacecbf34ea17a4be49b4101dc8.exe"C:\Users\Admin\AppData\Local\Temp\cf26a2286e3c6e3af6ff851778115d8b43b40aacecbf34ea17a4be49b4101dc8.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Checks BIOS information in registry
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB