Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 04:32
General
-
Target
54695921cba45873f83abd20fd48fe44.exe
-
Size
2.3MB
-
MD5
54695921cba45873f83abd20fd48fe44
-
SHA1
efbb580af2e686d2470f239a6688a18c89910e98
-
SHA256
71f8d67454fc5341f12bb1f2a9f1f9dafd867ee53d2dde42e2979697f952d05f
-
SHA512
9b283288af0de4db8593a557d67486f4b7d2af90bf0d8c22f55d61c82e4e1c222bf675d447c62a644c30e847b682eb6c740325cbb0a7f829e300ebe903549e22
-
SSDEEP
49152:/4EDgkyNw8yhyiwn9QUQi2QOPiSBUuhIKnNpaYZ6u4v3nt4zm/DBFHqAYAyYjrn:QEDgVNNL9QUQiePPTnLa06xv3nZDBZqO
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
Sets service image path in registry 2 TTPs 2 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: LoadsDriver 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54695921cba45873f83abd20fd48fe44.exe"C:\Users\Admin\AppData\Local\Temp\54695921cba45873f83abd20fd48fe44.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
\??\c:\TITI.EXEc:\TITI.EXE /nogui c:\kill.txt2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
714KB
MD530f3680e007d924960fd65524de36601
SHA123f1e67e28052188432d2031335a79cb5ae72a8f
SHA2566485271fe48f7be4cb49735c60fa4cf2ff52f235e2b24bfba22df6ea75fda1d7
SHA51233323b60353430962ef0e07dd166625ae8cb1d2080f75859d35cf0c807d146ccd7272feef37ebbe8ce77f988658ef0dee6602f9b1bcf429cd0c1898862b5091a
-
Filesize
574B
MD5f729045a51896f374fee1ab23eb8fe7f
SHA162890664667b1f3361eadf1d7c4bf61ae0477370
SHA25640bf96d24a051c9fd666c603e29ce70e1dab97feea0406fd32a167bb44c2c8c6
SHA51240b7fd24237046761700364e4d3be4fff69913862385d1833d43430a90b0b90ca0762b8c971bda16ec8c6c936f344a5898375212b25073ae2f9e7932efac9c36
-
Filesize
132KB
MD5db9b1cc34b35136f35e333de520c15f5
SHA1538bc7ab67c44c44e998bac022fefdddbaa1976f
SHA256f192a871ed2e942275aa3629351c08eb8383dedec7c10024fda9b642633685e1
SHA512c4e48ed3691c6396a8e2829718276edf12d5537d007266ae796b8089f0967bb0659b2fbc757ed9b36e88a2a1d5e5f22f7b8f675396982d01fe5fcfb91ffda580
-
Filesize
220B
MD59fe21a38099fb1bfbbb0d8555d538c79
SHA1efd76f4b54e003aca641ac0474298bbf39a193b0
SHA2565d2b8cd96c7721e2eaecdf7d9b3aec6f8599b2202c159886005581112f4f557b
SHA51225935e8989ff09cbfe5fe682aae3e5c6c64bd71b947a8c580e5fbc93170c6b3602826a2deadb2450a149beb4530301734a7b4a7e29ed8ed59076c995bd8f91da
-
Filesize
2.7MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
2.7MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
4KB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
5.0MB
-
Filesize
2.7MB
-
Filesize
2.7MB