Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    16-11-2023 19:47

General

  • Target

    773fdf3fdf75cde01a352c49cd8a42dccdbb6106c2cfc055b8cbe3be07989854.exe

  • Size

    1.9MB

  • MD5

    23db7ea3fa9cc6c839b285608b413384

  • SHA1

    8e46e6effa93d55357c12ca2b08834b619ca16ae

  • SHA256

    773fdf3fdf75cde01a352c49cd8a42dccdbb6106c2cfc055b8cbe3be07989854

  • SHA512

    618972ee05154efda8d00ef7150783ea70cd9e916c9f310c65dced3dfd7c43c2fcdba610b2afbeb28b87557cffe0b5cb332f5d346eb48c7cdf21a0993ce91c08

  • SSDEEP

    24576:7+ioUOc9BTsQQylvzo1GxVTCHmAglb3E02pgIN3YSWocxVAaH7IIO5Pq00ip4eVl:7vVzlLHVGGAAoNIjoiVTVGR0GVQFyHLF

Score
5/10

Malware Config

Signatures

  • Suspicious use of NtSetInformationThreadHideFromDebugger 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\773fdf3fdf75cde01a352c49cd8a42dccdbb6106c2cfc055b8cbe3be07989854.exe
    "C:\Users\Admin\AppData\Local\Temp\773fdf3fdf75cde01a352c49cd8a42dccdbb6106c2cfc055b8cbe3be07989854.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3012-0-0x0000000000400000-0x00000000006A0000-memory.dmp

    Filesize

    2.6MB

  • memory/3012-1-0x00000000751D0000-0x0000000075217000-memory.dmp

    Filesize

    284KB

  • memory/3012-811-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-812-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-814-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-816-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-818-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-820-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-822-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-824-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-826-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-828-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-830-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-832-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-834-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-836-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-838-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-840-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-842-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-844-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-846-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-848-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-850-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-852-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-854-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-856-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-858-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-860-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-862-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-864-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-866-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-868-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-870-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-872-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-2547-0x00000000021F0000-0x0000000002371000-memory.dmp

    Filesize

    1.5MB

  • memory/3012-8688-0x00000000023A0000-0x00000000024B1000-memory.dmp

    Filesize

    1.1MB

  • memory/3012-8694-0x0000000000400000-0x00000000006A0000-memory.dmp

    Filesize

    2.6MB

  • memory/3012-8701-0x0000000000400000-0x00000000006A0000-memory.dmp

    Filesize

    2.6MB