Analysis
-
max time kernel
138s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23-08-2023 22:06
Static task
static1
Behavioral task
behavioral1
Sample
678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe
Resource
win10v2004-20230703-en
General
-
Target
678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe
-
Size
1.3MB
-
MD5
511dca10841efbbe62b3e93425e30837
-
SHA1
fcfb71fc5fb9f516812fb9bad86ba11ecec122b8
-
SHA256
678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782
-
SHA512
1638b940277fe4ca07e8e790cb7e1764f6909d9e55dcf60923cec7a3076077781bf709166e74949f9b2a6e251f9e57b3704b00c4f28943e3ec70457886ba31f0
-
SSDEEP
24576:UcvaDKBaZSeA/+RvgswfkNoKUCuO5az/rhPV52oh:U1Q2RgkNo7Fz/VPV/
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe Token: SeIncBasePriorityPrivilege 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe 2156 678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe"C:\Users\Admin\AppData\Local\Temp\678783b16895bbe2bacbef2b176a44d328ad5b2191a8e0dfbe8a2eac54830782.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2156
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57f55d5c4a8e14ea0abaa01ba608c03e4
SHA1340b7a6a402efd3d3299c57597f79133373cf7ec
SHA25617e879e84fcf1d5c4de565e77b1baee3ec1a602053bcd1106f6cfa9df6f65a5a
SHA512ca494a4809f70a46124b78b3a327e2bc0749e26f779156103fc7ea362288fb2ca4c3ef0b232d4f8cea6f8f9d555f22bd88e3043c8a1483f50ce4c30d9baea515
-
Filesize
1KB
MD5a856278c58307ab4ea439594420e5430
SHA1a54dafa4c6e19bfa89654a1e58ad5b202f1726ef
SHA2565ffcedcb587f73bd26192b846c654ac04b6d1c536233524e76eef8bf1005e2ad
SHA512c2fcc19de229ec466c46f08ea300a92f36e8d29ddd51503c837cdc2d04f7c811279eb8ba548729c4a8ce68ce4ded2bcc6936c9c7832bd719dc5c336205bd9c34