Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
23/11/2023, 18:00
General
-
Target
d6dff46d13b4dd935a2f2754361fe6733d4b1201d0d88b65843a0d4abf989b7d.exe
-
Size
14.5MB
-
MD5
87d43ece183a7d7a589085b8ecc2ceec
-
SHA1
f32cb4aad1f47e51de17f4265f6cad5033a58e19
-
SHA256
d6dff46d13b4dd935a2f2754361fe6733d4b1201d0d88b65843a0d4abf989b7d
-
SHA512
5d135b6cd88d70cce872e6fd7fda99903a25fb70b903f6a4c73b9880ad8ca92cae9483a34835f9cc590eb0faac84a6abb9f843e102bfda16728ea676aa150f8e
-
SSDEEP
393216:a7/LuDxzwkqldhak4QB30A6oxuTYNytmEYOO:a7/LuDx0vdhakfBEA6oxuTkytmAO
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6dff46d13b4dd935a2f2754361fe6733d4b1201d0d88b65843a0d4abf989b7d.exe"C:\Users\Admin\AppData\Local\Temp\d6dff46d13b4dd935a2f2754361fe6733d4b1201d0d88b65843a0d4abf989b7d.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*ff46d13b4dd935a2f2754361fe6733d4b1201d0d88b65843a0d4abf989b7d.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\*.dll"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD54a70c27d4800bf524894899f50d8f497
SHA102af00b187bf4ad146295112dc60eeeef81fcf26
SHA2560a7d6634cd3f3788d5b4d0cf80e57ec2a3460a48172013ec19356302e60faf02
SHA5128fc1376ab5bab2fbb79cce28509acbf2f70ba0874f67f90158a300f4bf8bc218724a261b92181e6547ff01303abd8912a33a773f20cb006acf18c0eea7841d45
-
Filesize
1KB
MD5c0d7496332120d41a7e02d3411d9c5dc
SHA1e6ba7a30c5f3f86b57f48e61cfec77861492f223
SHA256538e316246ac4dbba92b1e7af7d195c67e5cdb096ead70f5a795450bfafdab7c
SHA51231f720082fa8c66e04f3ef833acd8073c75ae98ba6ce6eae81b22c422c2fff673a39b9963cc65d9e8ddb144d261c0fcb87ae826979cc28044abda6be9658ef08
-
Filesize
2KB
MD52da3deba5f134c4fffcd557789ff42fe
SHA1eb96ba3ea478e84251b18f0ad77181938075edde
SHA25662056286fbe574327b8fe2b0b899e73b9c155e7af5899ed41acf5550843625f8
SHA512f66988b6be82ada5f27652bed6a807ceea5ba9b1cc57f8e821cd2f912db3ecb99c461d74ca943b29ef0e1b79b0d3f559c5c45047de6d9a399517bff43631574b
-
Filesize
64KB
-
Filesize
33.9MB
-
Filesize
4KB
-
Filesize
33.9MB
-
Filesize
1.0MB
-
Filesize
4KB
-
Filesize
33.9MB
-
Filesize
12KB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
12KB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB
-
Filesize
33.9MB