Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
21-08-2023 02:33
General
-
Target
d1c85648be1c7edcd511fe27a8ed34ebb178a72b11e2a58ef81d84b4f316b6fe.exe
-
Size
15.6MB
-
MD5
7f05d5349410fd9a46c96a2d21378ac3
-
SHA1
e2c962cfe695503dc8c6f82d8986738503b7fb38
-
SHA256
d1c85648be1c7edcd511fe27a8ed34ebb178a72b11e2a58ef81d84b4f316b6fe
-
SHA512
59b5e67b1e5deb43c5936002040d9ff8a1453ddb8ae115a80cdba9a66281d4f9824b8a22d84fb8dfe32460a93b484d95f57978995e7f01a793fc54fee9c9a40e
-
SSDEEP
393216:9OhUh8cB7XqbwdTf+6EWCgGlYr/8RIkVJUpqxO0QJC:omabwdTf+5li2bJUpt0R
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1c85648be1c7edcd511fe27a8ed34ebb178a72b11e2a58ef81d84b4f316b6fe.exe"C:\Users\Admin\AppData\Local\Temp\d1c85648be1c7edcd511fe27a8ed34ebb178a72b11e2a58ef81d84b4f316b6fe.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.4MB
MD58b6c94bbdbfb213e94a5dcb4fac28ce3
SHA1b56102ca4f03556f387f8b30e2b404efabe0cb65
SHA256982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53
SHA5129d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32.2MB
-
Filesize
4KB
-
Filesize
32.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
32.2MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
4KB
-
Filesize
248KB
-
Filesize
356KB
-
Filesize
248KB
-
Filesize
32.2MB
-
Filesize
356KB