Analysis
-
max time kernel
60s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
07-09-2023 14:12
Errors
General
-
Target
88be20529ed15c95b7c9dc1ae66949fb09ebc934188de565a43e6fecf6bf63cb.exe
-
Size
614KB
-
MD5
c7d23cb33b0db8303d7cc43fb4d7fdcd
-
SHA1
b456525f89a5fc70d3022fc41dec753a8a84ab16
-
SHA256
88be20529ed15c95b7c9dc1ae66949fb09ebc934188de565a43e6fecf6bf63cb
-
SHA512
688b6efb0e2af25b6d8695171ce2bf9ccadc147beab555bcf836b38de884e8c854ea4b7cf4e951b1451caefa741c5c6a03cca1e824a1549ef374e8092f7b3da9
-
SSDEEP
12288:aiXf2YxXtNvqOt093nvo8eb+s5KaadA6r7/Z77u5V4nutiXhb+:xvtxdNvq98+CjadAY7E5VRtkZ+
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\88be20529ed15c95b7c9dc1ae66949fb09ebc934188de565a43e6fecf6bf63cb.exe"C:\Users\Admin\AppData\Local\Temp\88be20529ed15c95b7c9dc1ae66949fb09ebc934188de565a43e6fecf6bf63cb.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\lsdkasj.bat2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
143B
MD5afd85e05c28795f6befa3f6ddb2fb9d7
SHA1190322438076f7f9f5784eb9224f59b5f3598253
SHA25640e5aca2b2950ea278f65976df53cd39d3e7f96670f5d08f371c83689edfcb4e
SHA512d360b3a7f1ae09359720733768cf058aca0bc3ab63578c50378016fb6ef9b14f8ba60a52c9e273d4a5c46904c77f4680edd46af1b841b428eb030209b33677c5
-
Filesize
143B
MD5afd85e05c28795f6befa3f6ddb2fb9d7
SHA1190322438076f7f9f5784eb9224f59b5f3598253
SHA25640e5aca2b2950ea278f65976df53cd39d3e7f96670f5d08f371c83689edfcb4e
SHA512d360b3a7f1ae09359720733768cf058aca0bc3ab63578c50378016fb6ef9b14f8ba60a52c9e273d4a5c46904c77f4680edd46af1b841b428eb030209b33677c5
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
4KB