Analysis
-
max time kernel
121s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19/12/2023, 16:13
General
-
Target
59fe5bde6e6b2618e19aae781f18963b.exe
-
Size
7.9MB
-
MD5
59fe5bde6e6b2618e19aae781f18963b
-
SHA1
ac7b2e2d34e74bd353ed8159b97786777bbdfa1b
-
SHA256
ce67a35ffec02a360bf8560e19b94a3761be6bd81fc4dcfc3f38ae4312ad8ef9
-
SHA512
2cb2aa79a880f797918df2460048c9f69c0f09f32cc0dc9e7c4c4e0a1771f976016fe90a7e8a460eb4f9e7e87c221ce9a729b7e7fc496ad964f8a3eb60a754ce
-
SSDEEP
196608:fWwal3dal3POal3dalGQpmal3dal3POal3dalWal3dal3POal3dalGQpmal3dald:g3UR3UGQ73UR3Ux3UR3UGQ73UR3Uq
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\59fe5bde6e6b2618e19aae781f18963b.exe"C:\Users\Admin\AppData\Local\Temp\59fe5bde6e6b2618e19aae781f18963b.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\59fe5bde6e6b2618e19aae781f18963b.exeC:\Users\Admin\AppData\Local\Temp\59fe5bde6e6b2618e19aae781f18963b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
7.9MB
MD51b4e0f5b8cd6e6197ef6659df7c9babd
SHA1c5c04cc0e35ec3e8dc3fee5e24e30b70570c09af
SHA256b260f7731daebc134acf68ae1fc87822aed2b393ebe67c28b6e321682cfe176b
SHA512e4dde7ade9d554b61030adaa74b9060b0faba19e3a7f53447e532a0780a13d3c3dc93e35493e1b72e880e77ff95636e216658c67b7653190a88c16fa5faf1db6
-
Filesize
64KB
MD569b8e2fe3bb7142b759bbc3bd3092cc2
SHA1c55b032e44415d77a1a2f3f6c6c049b7cc32afd7
SHA256d31cf766104ab57466eca8c74b0b1dc3f7729270b60df98dde747087ec3e8bb4
SHA512c3b3ca6861a0e35822f0c5b6085f7fc1444b051548aec4362723d1b7a14b72cd832335ca29eea23ce8f9fb71f4ac76c6bf2b58a220722e7843461bf095970b7b
-
Filesize
7.2MB
MD5db8a9436110ba6cd1d929727d301b572
SHA1056d12230e8da864b57e5d7a3ba4aa98ef969605
SHA2564f78d2f58d0b4b36bdb11a5dc4a6c82f3275586c6baff063d6c8c5a2e7242637
SHA51260a364e5f58a081318583d08c4887fe59eb143de0c51071fa5678e0c7abec28ff69c94d209179cc29a10247cb5cf468873384c465859311a278abbb377b7a39b
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
4KB