Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
15/08/2023, 07:52
General
-
Target
Z28-FOR07-23 MV FORTUNATE IZMAIL-DAMIETTA.exe
-
Size
525KB
-
MD5
4a0a51789f3317db6e104be31b286e13
-
SHA1
51c3e59b8aad0f5b16a85e059f16082bb89d16cb
-
SHA256
fe976d946a11b69fbc5f63ceaca85d12966017a33abeb78fade52d492f2323b6
-
SHA512
0d776fbfd095b1dd82c40ec09b6c5cbec369fdaebe3916beae496822a43c85e57101418a6b0074f769310615ff02efaad9a4567062d660e6011df99acfa406f0
-
SSDEEP
12288:SyzV/Osh5Z3PwPM3Eh8H+t+VlQLuSqGAXKSkM14LGYgOIKx47:SyMS3/mMaHt+fQLxAjkM1VYX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Z28-FOR07-23 MV FORTUNATE IZMAIL-DAMIETTA.exe"C:\Users\Admin\AppData\Local\Temp\Z28-FOR07-23 MV FORTUNATE IZMAIL-DAMIETTA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZuDpJYxSRTjtl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZuDpJYxSRTjtl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1101.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Z28-FOR07-23 MV FORTUNATE IZMAIL-DAMIETTA.exe"C:\Users\Admin\AppData\Local\Temp\Z28-FOR07-23 MV FORTUNATE IZMAIL-DAMIETTA.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53ee89bb26bc059cc74b2e45a4a008dad
SHA12244210643035d74571648313209d11282634f17
SHA256ae4e405f7fa17ef05f8d173b02b86d21ada14f64e4e2f53ed38af3a10f6cab1f
SHA51219df00746c59c7a53c2c332ef9de5da2976078682b64b581480e6693e8634ba6ba45f59f1b15adf81dde3b6dfbdec9cd9e029ce0b4c71f15eadbcb2593cc5040
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
552KB
-
Filesize
256KB
-
Filesize
56KB
-
Filesize
256KB
-
Filesize
424KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
192KB
-
Filesize
192KB