Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25-12-2023 10:26
General
-
Target
1712b381f6b8719c5346b5752e3eb683.exe
-
Size
805KB
-
MD5
1712b381f6b8719c5346b5752e3eb683
-
SHA1
ebef6459c1b1e11e2509dec841b8e4bc3dcfe61e
-
SHA256
23de66bcc7ef1a42e025033730e10101149822aec65c0132f21fb67b2eaabec9
-
SHA512
2dfee8d9345088c8e32ecc83e1bdb2fb1546952d29b7d090cdb6e7b29da2f6844e2306759f65b7ac3bd632d33f4f603a06a7a812bca7c3e2534c1720e6bed114
-
SSDEEP
24576:OZgQdNnVpyPul3hdVcN/KuJg/kmd9p2wQ:mNTWPm3tcZKuJqkkW
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
Suspicious use of SetWindowsHookEx 11 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1712b381f6b8719c5346b5752e3eb683.exe"C:\Users\Admin\AppData\Local\Temp\1712b381f6b8719c5346b5752e3eb683.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exeC:\Users\Admin\AppData\Local\Temp\setup.exe relaunch2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 14363⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1996 -ip 19961⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
805KB
MD51712b381f6b8719c5346b5752e3eb683
SHA1ebef6459c1b1e11e2509dec841b8e4bc3dcfe61e
SHA25623de66bcc7ef1a42e025033730e10101149822aec65c0132f21fb67b2eaabec9
SHA5122dfee8d9345088c8e32ecc83e1bdb2fb1546952d29b7d090cdb6e7b29da2f6844e2306759f65b7ac3bd632d33f4f603a06a7a812bca7c3e2534c1720e6bed114
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB