Analysis
-
max time kernel
32s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 05:37
General
-
Target
0882034042f4b2c2d9ea830a30536054.exe
-
Size
95KB
-
MD5
0882034042f4b2c2d9ea830a30536054
-
SHA1
909a542a46057eb46fe48ff40b6c0d6157f102bf
-
SHA256
4ee3c4ed238e0b65b0e03e41c1ffe9c4317666dc5841fe8221756b4dd56466b9
-
SHA512
0fb1fc5bb796db23b2d4d4f1b996af907545a722f78a17d56269048797ce20390396af98aa2fd3ba8b7ae421412cc34d09acb40b92a3a3bc71b7166fce35d99a
-
SSDEEP
1536:gtWIGeD2IeDULK4QntaHnO0vRNfldcO3IuCbpZXsH2zhEw2GZsLAPd+9YQLeuhdP:JIB304QV0vRNfldc+wbzuYSw/sYd+9HH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer Phishing Filter 1 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0882034042f4b2c2d9ea830a30536054.exe"C:\Users\Admin\AppData\Local\Temp\0882034042f4b2c2d9ea830a30536054.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\winsys\9DDCFF4D3B5.exe"C:\winsys\9DDCFF4D3B5.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\82R4E2F.exe"C:\Users\Admin\AppData\Local\Temp\82R4E2F.exe"1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD529090b6b4d6605a97ac760d06436ac2d
SHA1d929d3389642e52bae5ad8512293c9c4d3e4fab5
SHA25698a24f0caf5b578e230e6f1103a5fba6aecb28a9128cad5520fcde546d643272
SHA5129121ec42fa66e14a4fc3932c8dbcc8fb1a93ab9de00da57a82e176faa70b73f6992f8c5e2ab52c02fc28c8f0c59aee73b6fbbd39107db7d15105054f4390e9be
-
Filesize
4KB
MD5db4994dec26adf9d09a9bab24a2dcca8
SHA12535863a5e35952b2dabc8068fc139aa0c87a7ab
SHA256a298f8b9708d98dfa473426493d6b5d87b58938defab1e3ff7ecfa7adcff1f4e
SHA51271db8ef68660d57c08f135d56fe506ea824a601b3df4e369a0780ec5a58f9480aa2f7a9d5b00a508439b82d92418c20a741807190226066fd15c8a39ff26e5de
-
Filesize
95KB
MD50882034042f4b2c2d9ea830a30536054
SHA1909a542a46057eb46fe48ff40b6c0d6157f102bf
SHA2564ee3c4ed238e0b65b0e03e41c1ffe9c4317666dc5841fe8221756b4dd56466b9
SHA5120fb1fc5bb796db23b2d4d4f1b996af907545a722f78a17d56269048797ce20390396af98aa2fd3ba8b7ae421412cc34d09acb40b92a3a3bc71b7166fce35d99a
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
352KB
-
Filesize
960KB
-
Filesize
352KB
-
Filesize
1024KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
960KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
8KB
-
Filesize
280KB
-
Filesize
352KB
-
Filesize
960KB
-
Filesize
280KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
352KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
396KB
-
Filesize
20KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
396KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
20KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
16KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4.3MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
20KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB