Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25-12-2023 18:44
General
-
Target
3565e4f70ce5a1c2227f813f7f4b48f5.exe
-
Size
181KB
-
MD5
3565e4f70ce5a1c2227f813f7f4b48f5
-
SHA1
f7e79e2ea45cf8e429b811c9bfd502cf3bb0f440
-
SHA256
814e763791396858073e8bda611bf1795dfd6240cd2c4c989802a9e3e62961f1
-
SHA512
345bd46c2d3382ae6cef676b5152f44685dc9a224b8673971d6ba8197520b15bb8a19b1dd61f03aaf0815592e0b37952b5ff4714aa4de09123e356b02ccbb31b
-
SSDEEP
3072:BHooknwo1EyjyIshFFDBZt6SI/Ple7LllWH:Noo0F7OImFFP6Sc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3565e4f70ce5a1c2227f813f7f4b48f5.exe"C:\Users\Admin\AppData\Local\Temp\3565e4f70ce5a1c2227f813f7f4b48f5.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\msa.exeC:\Windows\msa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD573655b2b5e086612d8176c69657038de
SHA1c0f040b2b8698f210d35bcdecc291ce227b5958e
SHA256700f00272ef3b011d24ddd97f83d27fcfcb3f0894221129c60bfb34a75fae6b1
SHA512bd9c3806bae6ad9a7987a20ebeaf1b412088b7db2153be3b3f1effc3d680d612aadbcacfa7faa9ea7983e21fc882cded0e256a2f7610f2546da7817564a8e37e
-
Filesize
181KB
MD53565e4f70ce5a1c2227f813f7f4b48f5
SHA1f7e79e2ea45cf8e429b811c9bfd502cf3bb0f440
SHA256814e763791396858073e8bda611bf1795dfd6240cd2c4c989802a9e3e62961f1
SHA512345bd46c2d3382ae6cef676b5152f44685dc9a224b8673971d6ba8197520b15bb8a19b1dd61f03aaf0815592e0b37952b5ff4714aa4de09123e356b02ccbb31b
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
4KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB
-
Filesize
460KB