Analysis
-
max time kernel
138s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
31/10/2023, 14:12
General
-
Target
37fb73e9d5f08db0890409bcde20df16386629a9c65d7acc8808dbe18c7d15ef.exe
-
Size
2.3MB
-
MD5
26f7993482fdc70f05fba60c16260d78
-
SHA1
de3c91a3e6bc4e67531c6aa65263e640ed0ef4f7
-
SHA256
37fb73e9d5f08db0890409bcde20df16386629a9c65d7acc8808dbe18c7d15ef
-
SHA512
e10b4ee1e84eff8acbd48747c32f16463dd058c628b4937f385a2d9188b9e4bae7fcc859098854395890c631f40d4a0675797b3a8e9bb30ae072651a115d4952
-
SSDEEP
49152:RsfWsLmyWEYj6Z91kdwoxGbN6PFjsbzL+m9a23Unx0w/c:2yyXjZIdwox1sPz3Ux0wE
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\37fb73e9d5f08db0890409bcde20df16386629a9c65d7acc8808dbe18c7d15ef.exe"C:\Users\Admin\AppData\Local\Temp\37fb73e9d5f08db0890409bcde20df16386629a9c65d7acc8808dbe18c7d15ef.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD59b8b641b07f5509ade021dbdeb3981d6
SHA118764beb9fdecb1ef655fc1b46deb635e628fb9c
SHA256b19c3f093bbfeb49f9d0f08fa4e52257e2ef42614267d9086f5d38e54e0e9402
SHA5129c21c08444dbc175f3b349e0ec61a48a73af00674108ef5ed1a4f768866252150849af158efa843e1720559234d04e422a00a9703f07ce2e1e9c707ef4f58545
-
Filesize
110B
MD503390d4bb73c8da2cb4990d308322fbb
SHA17163b03486c18a546364622354ec7180910f9316
SHA256c20ac413ae93651e156641a4185ead555c450335d0fd4ad38140d90c5ca2c206
SHA5121c320c18d4f6c8309e883f8418ef56aebed4636a57afd8e031d15f83d48305415c6e7f0fa71f5b02a5254305707d189bba45e0a485363fb5abd7da289c3a7bf3
-
Filesize
14KB
MD5fcfef0a420868745207a274fd723a814
SHA10f73f5279237823fa2b2a8966ec3a3c56ab34dc9
SHA2561d7e5371af91284133b519e541d5d4da85846d24b2fd35c4ab04f69c87f6feb0
SHA51224df3a7b66a1b048cfcc3dad0e49c9acd7dcc614fa7bfcbd0b52c2ca2f283c8bbe1258b5a6b004cb7fbb70b81527ce5e5b9a11d8dad63f3ae09321e8cd375f03
-
Filesize
428B
MD5de6325fa699e6c5afc907026daf6b48e
SHA149528d5d0d5686991637f0a01a6463ea12532d29
SHA25639c3dbe6b09d9b06f8239ae50783799d66ab0ba3f1005208aa9a476b725ab15a
SHA512a948a0c1bfa4b1fd4cf71837d1625467821370a53a299860b3a23a6437f311a372b3b902aa3970530f4fa4c50221eceed91f5135f0c99802dabe015df21ca8b1
-
Filesize
202KB
MD5ec78b7be83befed9bf018524ee73aacc
SHA167df93ad4ccd14f36532d2260fd6600f066ed092
SHA25612cc2fd3ae8ab138ead3ea9d0b6ee71197ff551d7385a68e454626bde4b8bc2a
SHA512640bd487fe6dee980efc68d9135e3345478c7f9c24c31dff090c7c90a4a365fbb0f31a9bf5b5d6fc6c54969fb4ad595e9c60a7fe6bc89b1b4d2ab268ef2bbd4b
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
528KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
220KB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
6.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
2.9MB
-
Filesize
1.1MB
-
Filesize
528KB
-
Filesize
6.1MB
-
Filesize
80KB