Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-12-2023 22:11
General
-
Target
3f2a758e586530e2766bc3bdba5544b7.exe
-
Size
240KB
-
MD5
3f2a758e586530e2766bc3bdba5544b7
-
SHA1
b1f862a036ef3fdb3919d00ab74f0557a44488ff
-
SHA256
31fe8537e66145ca9bc6a6d97590502c81b219e15910f71347a0c9c53f98c8dd
-
SHA512
4b98a12d8254c87ffe532759cd352d866a414ee205dfe5fba7118d55129ff380e187897de804c6aa77aaead0148b1f1a37d238ff9dd2059276f58a0a85dea798
-
SSDEEP
6144:K5EG8SlGBvf7Up2RAks2YndrU6HLAb3runt:K5TlGoERo2+drU6rerw
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2a758e586530e2766bc3bdba5544b7.exe"C:\Users\Admin\AppData\Local\Temp\3f2a758e586530e2766bc3bdba5544b7.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\msa.exeC:\Windows\msa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5c0b089b13be1ca50b666442cd72212f7
SHA15d09e91848833470196e31fb044de4a6178f7802
SHA256340df03ec3feee747e7fef80ca6e0f3106b0996ef1cefd6b8ca7b34895b0d9d0
SHA512030295d89e67b90c6d818cb08780360fd3b3dd5e4ecae9e459dfba6838adf2b2ace8e66a628547682d0705ee73aadb2eebba044d64bb092b33961f752f2ed5f9
-
Filesize
240KB
MD53f2a758e586530e2766bc3bdba5544b7
SHA1b1f862a036ef3fdb3919d00ab74f0557a44488ff
SHA25631fe8537e66145ca9bc6a6d97590502c81b219e15910f71347a0c9c53f98c8dd
SHA5124b98a12d8254c87ffe532759cd352d866a414ee205dfe5fba7118d55129ff380e187897de804c6aa77aaead0148b1f1a37d238ff9dd2059276f58a0a85dea798
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
4KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
612KB