20e531bb8b135469d34c1732949174bcba184a8fd1b126e0513ce1654b765ec8 | Triage

Analysis

max time kernel
140s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 07:22

Sharing

Report Analysis Logs

General

Target

5c434e0d19bafcea38889665af6f47a1.exe
Size

192KB
MD5

5c434e0d19bafcea38889665af6f47a1
SHA1

d62cbbff0b612a6d9a85fb7a413196a70fb1287f
SHA256

20e531bb8b135469d34c1732949174bcba184a8fd1b126e0513ce1654b765ec8
SHA512

b8f4770ba9ecc8bd1fd07701e9fe4c13a1290146286e928e748d82556cc4e8b2d988ba4fab90dc11ffadd184ff6a36c9916486fc217ad2487306774b213f7d61
SSDEEP

3072:SWXZedZBUDfEb3Lxz/GUtgTMuYIoL7nFw7nQd:SWOBZbwUfuYIoFJd

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kdieobbsaedf.jpg	5c434e0d19bafcea38889665af6f47a1.exe
File opened for modification	C:\Windows\SysWOW64\kdieobbsaedf.jpg	5c434e0d19bafcea38889665af6f47a1.exe
File opened for modification	C:\Windows\SysWOW64\calc.exe	5c434e0d19bafcea38889665af6f47a1.exe
File created	C:\Windows\SysWOW64\calc.exe	5c434e0d19bafcea38889665af6f47a1.exe
File created	C:\Windows\SysWOW64\__tmp_rar_sfx_access_check_259392893	5c434e0d19bafcea38889665af6f47a1.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2328	5c434e0d19bafcea38889665af6f47a1.exe

C:\Users\Admin\AppData\Local\Temp\5c434e0d19bafcea38889665af6f47a1.exe
"C:\Users\Admin\AppData\Local\Temp\5c434e0d19bafcea38889665af6f47a1.exe"
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2328-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download