Analysis
-
max time kernel
141s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 21:27
General
-
Target
3d6af240c51b5ff3e95a559a682cffa1.exe
-
Size
154KB
-
MD5
3d6af240c51b5ff3e95a559a682cffa1
-
SHA1
5f99eba0066194747775cb6bb29f87822ac6d762
-
SHA256
cfe7f95d0a2118740322f95f248d7bc7987d20813153a0dea0602182320b61e3
-
SHA512
e46225c919198ac38b08b4d80ad1232c2d356a4e6872c5ac7a9567ed3e6398f76845fbd7beafa57d81f3cca55dab82925d4885e5ea1df8d4d23f6c97fd5b91a8
-
SSDEEP
3072:Hbg2EvTSRliktD1Yb6fldMX77LoBZPSdcbNF8iI6IZCnhyp:5E76ikFzNCXnELPSuPuZsQp
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d6af240c51b5ff3e95a559a682cffa1.exe"C:\Users\Admin\AppData\Local\Temp\3d6af240c51b5ff3e95a559a682cffa1.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Installs/modifies Browser Helper Object
- Drops file in Windows directory
- Modifies registry class
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
4KB