Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/12/2023, 17:44
General
-
Target
31e0aebff300d9772fd24ed4ee48414b.exe
-
Size
121KB
-
MD5
31e0aebff300d9772fd24ed4ee48414b
-
SHA1
cac603a5b30fbbea44ef170ba27e68949c871ddc
-
SHA256
c6e88b6026087f9204eae9d344dd857fb5b7b820b35cefa36f940dc305fc304b
-
SHA512
2e4507342242bf7a3e1da190ef15a07916337ddc601d19f4e2a63666eaa8a7678ca6c91023bf7d5f5275e60f0ba38f04c09d2cf73c586e2ae4e65294571a34c3
-
SSDEEP
3072:NXvvRDNzgfAtykj7Y4GMSxNmyEsH5DFHEjrTznBt:N/JBzntnjbGPxNmyXH5RQ1t
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31e0aebff300d9772fd24ed4ee48414b.exe"C:\Users\Admin\AppData\Local\Temp\31e0aebff300d9772fd24ed4ee48414b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Wvevaa.exeC:\Windows\Wvevaa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
364KB