Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26-12-2023 04:00
General
-
Target
527126441f127d0acc6b8b7b6cdffa51.exe
-
Size
8KB
-
MD5
527126441f127d0acc6b8b7b6cdffa51
-
SHA1
a5f321715f74c31543d518f3fd72052d600ea550
-
SHA256
d47cd0dd8b41a0b4ff12b4bf8484af9bffaa6a7db232cadd76d19b7eafa151ea
-
SHA512
3da97c2e6f06b7915bd267b873550f0ad94c4ebfbd98199c42e7e65358d0f28de9fa11a3438a633dc04df815c217dda34b132092185d723ee2b3265772c4bb96
-
SSDEEP
192:ll5F9JdXTJJktHmoC6vKW4zGiFPBpGlqFdap:3jddJkt/rvKDzGiF7dY
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\527126441f127d0acc6b8b7b6cdffa51.exe"C:\Users\Admin\AppData\Local\Temp\527126441f127d0acc6b8b7b6cdffa51.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5bcf07918193803a2f8ce194f5f654a13
SHA170def138d5389c6fd4287644fa4e429f559da915
SHA256a9bd68186813e47a50f6c381d2132089f6661c2dbce272c85bc14233b020de23
SHA512afdc2e037c4d36a9a972bef5513592a4a9eae7d16a36d94e275e305c05f54dce748ef7f85a753fe8407896b7aed92c842d7b6a978e3b9c13632a1861e89b9e78
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
24KB