Analysis
-
max time kernel
150s -
max time network
30s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
-
submitted
07/07/2023, 19:18
General
-
Target
0efb5d611c28faa7d7ebf9f3257a81d17e7951207929025615501105567de690.exe
-
Size
5.7MB
-
MD5
063ce9d16ea680455316e3d5a81a9ec7
-
SHA1
4eb16500713b87917b9a77cc880bd85c41693577
-
SHA256
0efb5d611c28faa7d7ebf9f3257a81d17e7951207929025615501105567de690
-
SHA512
65524a5dac00ee80060ea6c20427878270a6454f5ac4e09eaa83968236aaafdb26b1f970ec0757c20c20c2d2f2ee0662c0f2531c310c9cf575b56497c769cc4d
-
SSDEEP
98304:fSnJqmshxKwEdrbSrt5NYqtv3C2nngdb5/HN1ZEti6pb:aqthQ9MPYqtv3CEnY9/DZEjpb
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0efb5d611c28faa7d7ebf9f3257a81d17e7951207929025615501105567de690.exe"C:\Users\Admin\AppData\Local\Temp\0efb5d611c28faa7d7ebf9f3257a81d17e7951207929025615501105567de690.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
328KB
-
Filesize
6.2MB
-
Filesize
4KB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB
-
Filesize
6.2MB