Overview

overview

7

Static

static

1

Output-Arc...03.exe

windows7-x64

7

Output-Arc...03.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    140s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 14:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Output-Arcade-Sound-Library-Content-V2_542703.exe

  • Size

    8.0MB

  • MD5

    9d19ef24416dc6b5e1a4a55d3ecf1170

  • SHA1

    8a543bceeb2befc581b4eae5a899c0ac2bd303c2

  • SHA256

    f151313bb9e4bfbb79ae1c89cdf99e8479d8aa3702a3194e7a4d950db550297b

  • SHA512

    893d583d0f1cd55bc446c0584917616262e39ea963a57b12cc8cd863d7f30c3dde455e84625bf7003ed4ba53cd8f889a2b8b80654ce6c976dd2ddfd182d3a2f2

  • SSDEEP

    196608:7/qT4X1l1JMZMLcLL29k6Pu6SRRWj1JUJEcAXKFKBeNIZtWbV:rQMLcLL2W6Pu6SRi6AX4KN3WbV

Score
7/10
persistence

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs 6 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Output-Arcade-Sound-Library-Content-V2_542703.exe
    "C:\Users\Admin\AppData\Local\Temp\Output-Arcade-Sound-Library-Content-V2_542703.exe"
    1⤵
    • Registers COM server for autorun
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads