Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
30/10/2023, 14:36
General
-
Target
1ea13db388c586ee58342141627463dbf4d4de173335b68be596948f39ade8c8.exe
-
Size
3.4MB
-
MD5
c99d42e2abe5b85f723ed9fa2b34c3b3
-
SHA1
04eba4e712fae29f4e1f46ff2128fb3fdfc7b4e0
-
SHA256
1ea13db388c586ee58342141627463dbf4d4de173335b68be596948f39ade8c8
-
SHA512
0b099ec986f8c8d4df3eb989bf9201009a5427f0590d1575278026a0a8233fe1d1f99fa28441cd39773918eb0e86785a5fdde24c1083dfb806a1dcdac7d9f198
-
SSDEEP
49152:9NFeUeCraOnjzCBGJUPTPgTzqLfW8rYuRrU3fE9slk5Ype7ycBSeONYmMk:hTwfW8MuVKOsj07LS/NY
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ea13db388c586ee58342141627463dbf4d4de173335b68be596948f39ade8c8.exe"C:\Users\Admin\AppData\Local\Temp\1ea13db388c586ee58342141627463dbf4d4de173335b68be596948f39ade8c8.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\¶àƽ̨ÉÌÆ·ÐÅÏ¢ËÑË÷Óë¼à¿Ø¹¤¾ßv1.53.exeC:\Users\Admin\AppData\Local\Temp\¶àƽ̨ÉÌÆ·ÐÅÏ¢ËÑË÷Óë¼à¿Ø¹¤¾ßv1.53.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5f71b71f76220e51cf6e0099e47898497
SHA1891b246b70072635e39e11c42c5eed5be9e9bfe7
SHA256443866b47bab4cbd4bd5b03c4013e7c634c91ee599f2e6cafc0ac32e7426f273
SHA512c72321c9647c7f44bd092d7c17fc24153e90b613074bcd8b9654afe8e07e20e8dceb90bb3bcecf43ad479987ae5ee2b650df72f1ca2d3ad06db748800153e240
-
Filesize
140KB
MD50a849560352cdcf03b6d678f08da6a7a
SHA11ca5fd12edc8f4921863301cc820f6deddcadd16
SHA2569c2f7a21ba0962f2078dcbed4b68602415012b0b4745ede5053555cafbee4b66
SHA512e114c3d0d38f373b2ae5b07ec833d7e98bdb43797641d374cacf69f868cc6c13945d337c8d04fc957ca8518dc4b6fed3bfe1448b4d30b0410e8f8fff31b2cc24
-
Filesize
1.4MB
MD5566eaea4900c6b4b395c90bb8ca48e25
SHA1160bbea95f2df73688c8aabde130615bbc2050af
SHA256193a475332a24d43c295774088e8ff80365d8d4e97af1f1180d3154be38b8749
SHA512ad42005d82b1d9bef30aff5b0e74fbcb86e56a7b1bc94c721939d126fd8010f7934bab752f4fdc077056af7f09ba7637d281198d5ac9a71185f0426deb61a2e5
-
Filesize
1.4MB
MD5566eaea4900c6b4b395c90bb8ca48e25
SHA1160bbea95f2df73688c8aabde130615bbc2050af
SHA256193a475332a24d43c295774088e8ff80365d8d4e97af1f1180d3154be38b8749
SHA512ad42005d82b1d9bef30aff5b0e74fbcb86e56a7b1bc94c721939d126fd8010f7934bab752f4fdc077056af7f09ba7637d281198d5ac9a71185f0426deb61a2e5
-
Filesize
1.4MB
MD5566eaea4900c6b4b395c90bb8ca48e25
SHA1160bbea95f2df73688c8aabde130615bbc2050af
SHA256193a475332a24d43c295774088e8ff80365d8d4e97af1f1180d3154be38b8749
SHA512ad42005d82b1d9bef30aff5b0e74fbcb86e56a7b1bc94c721939d126fd8010f7934bab752f4fdc077056af7f09ba7637d281198d5ac9a71185f0426deb61a2e5
-
Filesize
1.4MB
MD5566eaea4900c6b4b395c90bb8ca48e25
SHA1160bbea95f2df73688c8aabde130615bbc2050af
SHA256193a475332a24d43c295774088e8ff80365d8d4e97af1f1180d3154be38b8749
SHA512ad42005d82b1d9bef30aff5b0e74fbcb86e56a7b1bc94c721939d126fd8010f7934bab752f4fdc077056af7f09ba7637d281198d5ac9a71185f0426deb61a2e5
-
Filesize
1.4MB
MD5566eaea4900c6b4b395c90bb8ca48e25
SHA1160bbea95f2df73688c8aabde130615bbc2050af
SHA256193a475332a24d43c295774088e8ff80365d8d4e97af1f1180d3154be38b8749
SHA512ad42005d82b1d9bef30aff5b0e74fbcb86e56a7b1bc94c721939d126fd8010f7934bab752f4fdc077056af7f09ba7637d281198d5ac9a71185f0426deb61a2e5
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
-
Filesize
3.5MB
