Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 14:37
General
-
Target
262bdfad94ac2181681416101e7b272a.exe
-
Size
216KB
-
MD5
262bdfad94ac2181681416101e7b272a
-
SHA1
9f0ca28663bd8b4be857853652e3efbf21274287
-
SHA256
c18c082d9993ca7b7a83f5327edb5d485bebf8e03c57b9a5b3d7a8ec79f4eeee
-
SHA512
6f5d3be18e7b7704856494a324824615ad12b34dd7bc691b874492917cfdfd82db412394e441f2a6371fd157b41fa18ce58458d8b81177731f79da1973bc5f85
-
SSDEEP
6144:m9fxszZNj1MAIBQcF91qZteVHxzi9ya5c6LNQ:IxszZkAbxk1aya
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\262bdfad94ac2181681416101e7b272a.exe"C:\Users\Admin\AppData\Local\Temp\262bdfad94ac2181681416101e7b272a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Onixia.exeC:\Windows\Onixia.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216KB
MD5262bdfad94ac2181681416101e7b272a
SHA19f0ca28663bd8b4be857853652e3efbf21274287
SHA256c18c082d9993ca7b7a83f5327edb5d485bebf8e03c57b9a5b3d7a8ec79f4eeee
SHA5126f5d3be18e7b7704856494a324824615ad12b34dd7bc691b874492917cfdfd82db412394e441f2a6371fd157b41fa18ce58458d8b81177731f79da1973bc5f85
-
Filesize
344B
MD559fbb8c5475c52b21c54c9659f072532
SHA169c05791bced869cbbd6b4d5a69ed640673d3372
SHA256f7fb95c376c8c89b733dc9d9ab8343bb03dd987f63beb9b111baefe0dab72e98
SHA51213412639e40d10208ad8d7f000e977c881bde7fe4746dc63ea0d0b436efcdaf2ef2b80bce9b4d8ad0193a6b6aa84ceabe360d671549c34c50a0a4ff3c20d075e
-
Filesize
232KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
4KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
476KB
-
Filesize
232KB
-
Filesize
232KB