Analysis
-
max time kernel
157s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
05/11/2023, 15:55
General
-
Target
612572044bd877ecefa2e44f00e638aba7885cc422de3a5392f95ca41d9818ef.exe
-
Size
274KB
-
MD5
feceafeaffad561d722578218c3502d1
-
SHA1
b0a43b9f963ecfd01d610b0aa0b2a51efe3dedc6
-
SHA256
612572044bd877ecefa2e44f00e638aba7885cc422de3a5392f95ca41d9818ef
-
SHA512
a83b8eaa5b87aaf75b4b51c98b72c28574ecd2dc3e8caf3b6fb4dcf221604ab995a5bd535c2c2426e05e7d09e8c20973f20658f5904999c776c9f8308c8dbea7
-
SSDEEP
6144:3bTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:3PcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
-
Deletes itself 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Drops file in System32 directory 9 IoCs
-
Drops file in Program Files directory 26 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
-
Modifies system certificate store 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 59 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\612572044bd877ecefa2e44f00e638aba7885cc422de3a5392f95ca41d9818ef.exe"C:\Users\Admin\AppData\Local\Temp\612572044bd877ecefa2e44f00e638aba7885cc422de3a5392f95ca41d9818ef.exe"2⤵
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\612572044bd877ecefa2e44f00e638aba7885cc422de3a5392f95ca41d9818ef.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b25df32f32093aa5017278dc20341e29
SHA1721db19673f39ca92f2f35ec7b4cd5cb93d195db
SHA256c7d060cd2ec76a9699d7e4c34af8271b690b56d2f9a0d54013805bb31fbcabd3
SHA512e3852ab9f5e0a917a41de5cf508b46daea56ba50fc5246585f9eb4766329beb87d2b610ccc2548be0232087f48dfd2427bc30948fdb754f7e006a2b2c169b0d3
-
Filesize
1KB
MD5a9e43827fb0ca7c2858750473ef62701
SHA1b49ef1c3cbed5cbf1f4e2ab51f1b89d8d9c1275b
SHA25681baa6040bb7ee6da15cbc5ceb144454b69a5ae919821049ba9890d86de8aaa3
SHA512b7813d1f8ae227548890223ac522de440ae8106b7e7df93aa3e1d8da3283b1f860334def62ad5fe5d89642606fba6e0e3d5e41fc758d22eecd2afd66a6feb9d8
-
Filesize
599B
MD51c948680791ec4fba211ee0cf39c1e6e
SHA1c05683ee4831ef05e2b90c20d8c4617c9b424297
SHA256db11d0f5ff24e306e84492a9c07f7f98db0b66be123f8b3af0dc84d23eb162f2
SHA51246daf35ad307ad97fad382171a4c3bfe550380208faf75e1861d32304d26014464c21a4975372e896adfe46fe759a63208b12c3a1d37bc996118d38dd2a8c47b
-
Filesize
484B
MD5c8d2278404a52b264330d0fa14282895
SHA13c58ebe41525b7f52d791eb991329c67802f56c1
SHA256021fa14d2ea4d58b6a9939f1120d15656abbcb66ac449a27e3c4ad5ef1d3a495
SHA512ccf9d1462b34b13186f0cd1159df1d580b39fab3f7a73b65ef7f318a786a4b75b331a0f883db4208320b6253c37454cdc690fae99caa3485a82fec17d32b7665
-
Filesize
344B
MD5408892d06045046603121f77909459a5
SHA1692313e34554111fe973fb77a5520d6d30fb293b
SHA256716106623dc18db891d5bd022d98801a254bf44724000421399b6faca3c428d4
SHA512c111d8924a314a59c33f61f61831c37620da4029baf5ad7083a7a92ad5b617807d4e199b0fae35bbea2cabd071e508e83552bd3b94348f196871ef606d9bde82
-
Filesize
344B
MD55c79d503b4995984f5e8497ef0fcfab9
SHA198a3c50ecafc54f4ba78a953b03e8b960e5a34dd
SHA2560fdb519d36f1b551d47fec59b3325f71f642ce61921b218f441cbaa8f8f6c0ce
SHA5126d09d9c3aa6b9647b1e8096896993cb4d62dc04bed39c769ede600150ff6dab421f4fa04291f41284c33de5c8de7348861eaffe676f6d5d04cec447f2f0f2386
-
Filesize
482B
MD53e39f23c43686c3eb88766f084da2fab
SHA19e736568747f11521c3ab86cd119049185389d41
SHA256a52ca58f03f797e18094d2c2632f6ad2c5929a84f0e39f00c8a819a8c957d4a8
SHA512ba8862e2afbf81fad0a1166519a1a7b44fd3633e3d88fe9f50426797e9e91197a1c2e1c16d2e8a952d5ab6957180391318653c56f1d4eeff2f7bb19e3c99a5e7
-
Filesize
504B
MD5c83887e756dc5593a55e19eb3c22b648
SHA17b8dc56aaa267685a9b6a7c283a789c9959f3de2
SHA25684f03b61b28998b8388127b4d9e3b40253641b927de2e87acec4cd207039f851
SHA51204ce736a6b68d0f0d94207cb121ea99312053bac9d31293bda50c7eba27d991c8712f364fefe8e5064d4a641306cb704ae5eb5da584da3463d99fc307ea5d7e4
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
447KB
MD56208d7fad9edc996844c827bf5743f7b
SHA18fd17442919d95b64471cf44db7be9d99a66e4fb
SHA2563bd7f0ec5f5c6748f15054eac6f01b32500aa57cc610e074aebf81c29d43d954
SHA5123465a58fd100bf251663d86168fdb67b0f6ebc9e7cf4727c6e8cf207828872f4264b52efe0aaf4d084f0536fe1df9d2e3ba31d7d0ba1e17d2f8155f025bb4091
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
415KB
MD5bad2f9bfa44df16202ec813e7afd2f7c
SHA1a92f63b526e6611cdc0a46955681d0a478a23519
SHA25622d508fec4b6eb90e77077843116c3dc90b4f79872048dde998e02a718712e61
SHA5124bd668c2ef7e7392ae86cba0a71d73df1d1c8b75715e99944f63bdefcdce20b787592b75b3d2c87022be68f8de47e0adac3ba088b4d11c02ed95231c500c2681
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9
-
Filesize
12KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
560KB
-
Filesize
12KB
-
Filesize
680KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
700KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
708KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
708KB
-
Filesize
700KB
-
Filesize
160KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
12KB
-
Filesize
708KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
160KB