Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
27/08/2023, 19:02
General
-
Target
6269ee00ffe27cd3a9e50f2186e705a58b09bf7e1542585dd9088e7cc339c3d3.exe
-
Size
536KB
-
MD5
cb42aa09659c1f113a7ac64cd50a78f2
-
SHA1
4200850ddab9adc264d81e0b5df774df34cd45ff
-
SHA256
6269ee00ffe27cd3a9e50f2186e705a58b09bf7e1542585dd9088e7cc339c3d3
-
SHA512
acfcdb4771644225ab14a6eda5502e3e92d8613d129e8b95973be50a8581f92c2802a232a8b3edb88188423c200a36636688899c97594e4ebb0ba3b645fe49ea
-
SSDEEP
12288:GOreCbJ6z1GZnCbPLwY5ZhUXy4Okx2LIa:yCKTYrOkx2LF
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
Delays execution with timeout.exe 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6269ee00ffe27cd3a9e50f2186e705a58b09bf7e1542585dd9088e7cc339c3d3.exe"C:\Users\Admin\AppData\Local\Temp\6269ee00ffe27cd3a9e50f2186e705a58b09bf7e1542585dd9088e7cc339c3d3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\6269ee00ffe27cd3a9e50f2186e705a58b09bf7e1542585dd9088e7cc339c3d3.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\Logs\gpupdate.exe"C:\Windows\Logs\gpupdate.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
-
C:\Program Files\Common Files\wlrmdr.exe"C:\Program Files\Common Files\wlrmdr.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD51b79536d9033da4ee3b8b21354dbd391
SHA109b4a38f0a6960768f26ef86a30bc0167e690f50
SHA256385b4553cbef207d9c5e466002940c205d51b1e2095fa8b442de1f64d6512f95
SHA5122475b0352929d87090d92d1d6b2cb3db97632d780bf898c1c44f9169d513752f1ef26df476f9eb8487e75cbdc5c5584e3a4470cfedcea709a39cd82a59c190ae
-
Filesize
2KB
MD54da9a0a3b7864d1fa750b3418ece5c99
SHA19463443a2c43ec88ada23c106c4e8ac12bd81217
SHA256eb7479189ad6954f6c836ef2c43f39f59d032e5766953ed7fcc5f7a2dd1275fa
SHA512e770356021f08a52766e610c542be7d3ac2a527ae27056f28737e6c52b34756bf705aa7d7a3a5eeb71ffae8f72dbd5a9b0ef69eac3b57b9e2002ec6732a0eb4c
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
1KB
MD5ce12199317d03aeb98e9ab4deb8a2400
SHA183c807a97e94c4a5c943711282434fcaa52f23b0
SHA2569bac42ac5078f27a66f09d9c94507ba81716ae946080673963ddca4c70f04688
SHA512041bbf8cdd894eec2a2430625c6072778149684d86d274c5e307b2ca3d1964063ca50e9df7df7da3f5a93949dc053d8eb80d35661b905571a517e58c437b963e
-
Filesize
599B
MD5c794e3e3f666c65943e1f8c10f6de2fe
SHA133dee0f125d0996632c1fdbe3bd0cfdc2be10d46
SHA256a77c0e54fc17ef7e35c67ce7cdad7dcb28f93ba2355a06e39d22a625568cba93
SHA512e95ec7b8ece8abe1e1313aa862c707f2ad8a02b99d81b02847a5f4655084228784f00106307fe61fe6a5b0311f31868b490c148f9fc52c668fd7bc6f4e14feb7
-
Filesize
484B
MD521b19a5babde3eb6a89301bc4b2d76c0
SHA17e5b6feccb5a4164525968c3c3d49c8d0c5d3478
SHA2564458a708069861e301022c5da2f2e245fc30501c533ddb24759ae91b0d38c5bc
SHA512efc7f7266c9ae10f9bea46e0ac2882433872d4a81d5c1999533a285051c4f6fa5ab166e9db55252b1bd9e17e8ebf6ace2d9ed98befd09bb2e754530721f0e491
-
Filesize
344B
MD5caece20f6f6ea638d0ba78bd261c33da
SHA13fd7ea33f4d0f16d5120e79f9dc03185d6f5c9c1
SHA256fa49bbc999dde26cc4f1464bef75e315dfd89c450941b13c527e650ee03f2064
SHA512d0a1f4cfc0967ff90e0b39b17245c3a1054fbb8eaebd2c3386a3086279b5f3444ef46d0cbdade55ea7823a9b70dd1ed0110cdd791afeddab515950729824bbb0
-
Filesize
482B
MD5f786407eda7515bd27a4ba4164106e8f
SHA177d3ea83a76acd799f8cc6985245df37e23590d6
SHA256b400acdefe6463d7c0f5ead3da9d3ee961eaafc8e7b00c91bdbebdb0745b2b7c
SHA512b17810b0cf53c15ea0268790022a509a2357eff6c706087b63b6ae1562db9c65e8491e70f932f9348aa71a0cb8de64ec68e8b6a26a123dd0a837cbbd57f93801
-
Filesize
504B
MD581f74dfb846bb0460292f70e946983a7
SHA1f13de40967a577366bdc49f9be920583153f1d68
SHA256d45ffa924259642b6e70313d1a674118a64c10295af28cb325eb1b68c0326f29
SHA51222936ed7da479c50868719271e0e157fe4fdf359853b70edbbbb033c1556a8ec00b9ffefcf5b3d5fa8b7f02cc9dae5c881c771d23d85ff025a54004bcde0b380
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
17KB
MD5275e5264a5ea33fd683a0fdda455e521
SHA115366e7220e795290786c984308f6ed5ab29598d
SHA256237d27be77622c6a6c8f4518fc266625205bc09e73592f499d612b68318f00ea
SHA51253ba6545b5476930f08eab2f8a02acc81c5329c53f5befc8d0284e2a1b782116e03f3357a7715354a447a261bbdacd04080f3d7da51c189ed8a1db0a1f06b96b
-
Filesize
43KB
MD51b79536d9033da4ee3b8b21354dbd391
SHA109b4a38f0a6960768f26ef86a30bc0167e690f50
SHA256385b4553cbef207d9c5e466002940c205d51b1e2095fa8b442de1f64d6512f95
SHA5122475b0352929d87090d92d1d6b2cb3db97632d780bf898c1c44f9169d513752f1ef26df476f9eb8487e75cbdc5c5584e3a4470cfedcea709a39cd82a59c190ae
-
Filesize
17KB
MD5275e5264a5ea33fd683a0fdda455e521
SHA115366e7220e795290786c984308f6ed5ab29598d
SHA256237d27be77622c6a6c8f4518fc266625205bc09e73592f499d612b68318f00ea
SHA51253ba6545b5476930f08eab2f8a02acc81c5329c53f5befc8d0284e2a1b782116e03f3357a7715354a447a261bbdacd04080f3d7da51c189ed8a1db0a1f06b96b
-
Filesize
132KB
-
Filesize
12KB
-
Filesize
160KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
812KB
-
Filesize
988KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
640KB
-
Filesize
12KB
-
Filesize
640KB
-
Filesize
12KB
-
Filesize
988KB
-
Filesize
640KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
60KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
972KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
812KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
812KB
-
Filesize
812KB
-
Filesize
812KB