Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
08-12-2023 02:08
General
-
Target
3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05.exe
-
Size
668KB
-
MD5
8e0d4e580ae0361aef902eb9f2e952ff
-
SHA1
20ab04747e22eb1ff6cb8956cebf2f1876add6f1
-
SHA256
3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05
-
SHA512
84caa76bc127159aa4a5caf807ebd8a85e62c1ca117dbd5c28bb17e6e76c2b426298dd091d4c5503dbace3a41d8c57bcef4bc9d71773832abf71ae7ddb6c2351
-
SSDEEP
12288:s1CSfMlEPbEQwDLniL98GcVkTxFy/zTvfCVcyo/s52eACTT:ofMlEPbEQMLkZoiVX
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05.exe"C:\Users\Admin\AppData\Local\Temp\3a268c683729ba9c5975d4f8e63bb6cfe984cb6b66f5339b22ebf03743cc6d05.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden $derremc = Get-Content 'C:\Users\Admin\AppData\Local\Temp\fiskeboller\tekstilfarverne\Synapsed114\Henlggelse\Fetalization171.Eta' ; powershell.exe "$derremc"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD535200be9cf105f3defe2ae0ee44cea12
SHA13f4a09eeb477d3f048cdfb848b95aa39b20d89dc
SHA2560096ae873c75f4e4d802dc97eec9893acc0749a7346e63f25a8d52ba8e11c527
SHA512f8f7d8a844d588c6e2d6dc54e0d4bcbb1c4229a6e8f4d110a5e3d47eb0b8b5e0860ff5d31762229a731e08d7b232468b2a78c29778a9f0c62a7381db89175833
-
Filesize
6KB
MD535200be9cf105f3defe2ae0ee44cea12
SHA13f4a09eeb477d3f048cdfb848b95aa39b20d89dc
SHA2560096ae873c75f4e4d802dc97eec9893acc0749a7346e63f25a8d52ba8e11c527
SHA512f8f7d8a844d588c6e2d6dc54e0d4bcbb1c4229a6e8f4d110a5e3d47eb0b8b5e0860ff5d31762229a731e08d7b232468b2a78c29778a9f0c62a7381db89175833
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB