Analysis

  • max time kernel
    150s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    04/07/2023, 16:48

General

  • Target

    easyMalicious246baec5b4db.exe

  • Size

    721KB

  • MD5

    b79d8fa9aed9abfe89d53db1d0c11255

  • SHA1

    4d8554c2926a22a85a6534aacdf83669d312fdb8

  • SHA256

    28ddf248a2a5fcd96729f9107dc99aeec65588ff8e1bb2fb364588d37a9f4aed

  • SHA512

    77aeea72ed9076ee9d45051b08581ef82f99f0bec91f7c993757cf559318e1df3495c4fde4dce11d785dd3ce07f085acfac856097b5b22ae89ffd757021c338d

  • SSDEEP

    12288:V1bFpV896SFJF8AoY1NIpqRb46Q40LCplVMo7dM0ZpNnHZg4i5lz1te2:V1bFpGpErY1NPRkj40olVlpNnW4i5B1D

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in System32 directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\easyMalicious246baec5b4db.exe
    "C:\Users\Admin\AppData\Local\Temp\easyMalicious246baec5b4db.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in System32 directory
    PID:2308

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\DC++ Share\RCX2271.tmp

    Filesize

    62KB

    MD5

    b126345317624479f78fbf30b3a1fe5a

    SHA1

    655c966bf7bbf96ee49c83062d30b9dba17d693c

    SHA256

    8723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301

    SHA512

    d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d

  • C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

    Filesize

    847KB

    MD5

    2613375059b45d7ec633477919f1e42e

    SHA1

    1ab9b413368a6141c9b5f3cb60c6eb6745e0667a

    SHA256

    37595650c1f185a7b759bc1d87f1d4a8a7d8212213542a3126869dcf529daa44

    SHA512

    4ef828a3b159509b0a4917e966ae29e385b99483a47f9ee1641ac9cd12736279b2ea20e78b0e45ad1edc57b59d8f20ebe37f3b000a5c9e8664902a7f94ba258a

  • memory/2308-163-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-164-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-159-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-160-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-161-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-162-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-157-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-158-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-165-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-166-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-167-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-168-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-169-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2308-170-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB