Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
16/08/2023, 04:27
General
-
Target
4c99fb8d7c0caa49086abeff3d42aec6dc71163d430a6d3e170278d256ba9fa2.exe
-
Size
1.8MB
-
MD5
ad443d092610d8402179d5e61876153c
-
SHA1
3a68d45891c6bf924e305729b41803591abe91e5
-
SHA256
4c99fb8d7c0caa49086abeff3d42aec6dc71163d430a6d3e170278d256ba9fa2
-
SHA512
59627227eef34bbc9664e521228a7196bde394c1d62a50c4c5c5b8c17dbaa77a20d21f550359fbeaafc7a9ada2935bc30589e8fc594ae3e50b2bd1d76d64405a
-
SSDEEP
24576:ii7Y8G11kULARMkXO4LqHrh2sqIO0tblyQ58rnUnYb8RbtCHBIZ840Q5huO+h:iaoh2/0tcDzwvZCh7QM
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
-
UPX packed file 24 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c99fb8d7c0caa49086abeff3d42aec6dc71163d430a6d3e170278d256ba9fa2.exe"C:\Users\Admin\AppData\Local\Temp\4c99fb8d7c0caa49086abeff3d42aec6dc71163d430a6d3e170278d256ba9fa2.exe"1⤵
- Sets service image path in registry
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB