Analysis
-
max time kernel
184s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22-12-2023 14:17
General
-
Target
bd3e056d6f91d319c9c83d2a96fe4d7f.exe
-
Size
6.5MB
-
MD5
bd3e056d6f91d319c9c83d2a96fe4d7f
-
SHA1
d8a5fac5ff48a23517aeee61f3785d702612f7d0
-
SHA256
be899c46cecbce4e234f9ffa5016eb8aaeadd81c2783032b4e11b6db57c8958d
-
SHA512
d3e9e061706eab44864e734225bcb4103772d55d751fd08e869fdd4b1e63de138375ab73082c8ecde4e63f7c516d959697777ca1e11e2e4f155b5dcc5e8479c7
-
SSDEEP
49152:EQFRHrmQG+trBSRHrmQG+trsrBSRHrmQG+trGrBSRHrdrmQG+trBSRHrmQG+trsG:EcKXKAKegXKAKS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd3e056d6f91d319c9c83d2a96fe4d7f.exe"C:\Users\Admin\AppData\Local\Temp\bd3e056d6f91d319c9c83d2a96fe4d7f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yuqmgy.exeC:\Users\Admin\AppData\Local\Temp\yuqmgy.exe -run C:\Users\Admin\AppData\Local\Temp\bd3e056d6f91d319c9c83d2a96fe4d7f.exe2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5346d35d56eff36fc0f823045bb7d3239
SHA137d7c4b82dba4e25b820229728cbb4ec604fbce4
SHA256b7dbf91f7e4d35113b2700368d3a4590be3770e4bdd447a74c8823d7ec1ead9d
SHA51234836eca13d4ebc6724e79e282a19c8c1610ecb74c72b07557bc092cf27bf44b4f53017fd73dc09550f29597c31f9d7393dae97e095f2814dc5b5a4474d60de4
-
Filesize
1.1MB
MD58a3c798066939c585e309cb737149cff
SHA11af3e004f7bcf09b78aa8ef54e77717dd99d6eee
SHA25696aefbd082a56ff55af8740fac92965438723ca4e4edb6fc290e001dbe63c8a7
SHA5129dffa5e8fe7389dfb1c39dff6f2df39d6ef0ef51d32443392d34c3ec62da2eb8a6229b57f00a20c59741bae7fcd8660c3948722c1fb93b57eb2847232cf64ca7
-
Filesize
994KB
MD5f30f58fc34d4734152e53a40cdb5efb1
SHA1d999313f69fcf1fac563c5043bf4b501c6573740
SHA256a2359c44b5f139e35094bc85b75406a94adb1f8477e98382ecda43718c7b3d96
SHA512469421d612fb1a2cd52caae2fefa0c6af7e124cc938d801a9ca3f68595f8a2f9749e0ca6f26f0f33c894d5af105d543f1ceac0f6db97d4e8d690564415197337
-
Filesize
2.0MB
MD5eb965ba57b2dfa1ad4e60926fe8e6d55
SHA1fe0c48f164b0cdc226d10c8ea44568f32c1988b0
SHA256092e5a4ec88857f7632f9d1c09529329536b1e0c6c2ad4a89db36ff34dce3cb6
SHA51222ec94020ef0a197e9e279620eb7b2a9593f18fb3874726e24cf60ddfbfe3971a49a2087e9ac66f59ac4ee4371f186527de02eb857db79ca868e0fff53b6b2ab
-
Filesize
1.2MB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
320KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1024KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
1.2MB
-
Filesize
1.2MB