Analysis
-
max time kernel
13s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 12:46
General
-
Target
6f8e1ac87ccc5b0c1f4ef34d513bb3e4.exe
-
Size
134KB
-
MD5
6f8e1ac87ccc5b0c1f4ef34d513bb3e4
-
SHA1
5df5481ebef121f1650e03a4c97e8f576db16cb9
-
SHA256
e3e75e0e0a58ba276094b4953b13b34d1d996c748cad19aa8b0c49ccc8701568
-
SHA512
0522d4fcf5f854b5ea2e9e6a210326d2a9971f60f37f3f32ac18f685146f8a7a8c613423a46a9ed1380ee120c761244ecb23cae02881cdafd9f267b05069562c
-
SSDEEP
3072:A6Y86ICOgKZBEt3t04XaWxIBUFCneGFYYBuVTCFDQ:3Y86kgKs3t0PWWBCUeukCFE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f8e1ac87ccc5b0c1f4ef34d513bb3e4.exe"C:\Users\Admin\AppData\Local\Temp\6f8e1ac87ccc5b0c1f4ef34d513bb3e4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\Dfyvoa.exeC:\Windows\Dfyvoa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
134KB
MD56f8e1ac87ccc5b0c1f4ef34d513bb3e4
SHA15df5481ebef121f1650e03a4c97e8f576db16cb9
SHA256e3e75e0e0a58ba276094b4953b13b34d1d996c748cad19aa8b0c49ccc8701568
SHA5120522d4fcf5f854b5ea2e9e6a210326d2a9971f60f37f3f32ac18f685146f8a7a8c613423a46a9ed1380ee120c761244ecb23cae02881cdafd9f267b05069562c
-
Filesize
362B
MD52c092560b95ff1a1d467838457a40005
SHA1f816118e6a597647024a530a0dfb41cca80b573f
SHA256239a6a644b08000610bbff3483940e618c4a4b499c9d93dd69ca221c19405262
SHA5126eff38f988dc3584838a23ccdea4fa1f1d93fb7cde200dcced72d4c0da409b241a9cb2eef595b51f03efb38ca64ffddaf1f9a11a5da53da54bbdfcde5c693b9c
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB