Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
30-05-2023 05:01
General
-
Target
e717bea129d5b3b17b1d7b59cb31782f2561e7c560e190003dce7c62ef44f8d1.exe
-
Size
2.2MB
-
MD5
2032bc30b58069c446007e2f8d91c75b
-
SHA1
beab01a5544464bb50f326d80fe450910b897d62
-
SHA256
e717bea129d5b3b17b1d7b59cb31782f2561e7c560e190003dce7c62ef44f8d1
-
SHA512
2989ac76eec170becd44776b555d701a0c48f985b9568ead52aeda188bc2e0d3a183ea7824d795951c10aead721210b71285eb2df6c77a638908c1ebbeae411d
-
SSDEEP
49152:GosN5uxEXiemlxN/jh8APpMvO7qM7D1MuGssjK3gyo4Bbir8OlgwSml:GosNYKX9Uxxh8kkCunL23foYzHml
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e717bea129d5b3b17b1d7b59cb31782f2561e7c560e190003dce7c62ef44f8d1.exe"C:\Users\Admin\AppData\Local\Temp\e717bea129d5b3b17b1d7b59cb31782f2561e7c560e190003dce7c62ef44f8d1.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c echo t>C:\Windows\system32\administratortestpermissions100412⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5641⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3B
MD55696feb53a6ad364e3da313d7bb865c2
SHA143ac804404d56225c9e0e44018b43c0e46b4be53
SHA2569e8b03ea3b48312f8e3a15bec7aa85c96a362e2776ac6bc3dfd74a40022bcc8a
SHA512e4771bcec6bb86578ddb042a126683675e3cca83614f22bf44721b7cfddaa067ed162e692650e48a474d50e3de4728a6bfe4083500580998152cd2b4918b8516
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB