Analysis
-
max time kernel
150s -
max time network
184s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 16:03
General
-
Target
7b1eb3d9bd0f2bdf5a7ddde6187538f0.exe
-
Size
4.5MB
-
MD5
7b1eb3d9bd0f2bdf5a7ddde6187538f0
-
SHA1
94f1277f4ba0b763977fc81b0a697855dc04efbe
-
SHA256
f0aad21358e5bd6dcb417eb5ba67cd12fc44d96a0e78e4539cf0c8fb092f76d1
-
SHA512
e8e703bde4f2b9379300c267676c96faff43a7ef72476835b72e82cbd744384c1a57bb45bd370a7ee759abdf164ec54bc9f49904914deaed495b8cfd300e5691
-
SSDEEP
98304:PX4IgznrtSU2TbCrihayDNhMY3GIZDmQ8yazx14:vEznr4biiE89GOKQ8ya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 26 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b1eb3d9bd0f2bdf5a7ddde6187538f0.exe"C:\Users\Admin\AppData\Local\Temp\7b1eb3d9bd0f2bdf5a7ddde6187538f0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-USH64.tmp\7b1eb3d9bd0f2bdf5a7ddde6187538f0.tmp"C:\Users\Admin\AppData\Local\Temp\is-USH64.tmp\7b1eb3d9bd0f2bdf5a7ddde6187538f0.tmp" /SL5="$4010C,4052364,721408,C:\Users\Admin\AppData\Local\Temp\7b1eb3d9bd0f2bdf5a7ddde6187538f0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Enim\iste\Omnis.exe"C:\Program Files (x86)\Enim/\iste\Omnis.exe" 93d81216118a8bbdd4876576de06b9353⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD53b81a4a6925f44d7a85a7eccabc9ab02
SHA1f3c3629635e78ca0ef9a8ac8fe2997b461ca71cd
SHA2569203913bdd64de90455663bee2987a2485616762937f3197e32bf3bfb3f2af06
SHA5121840ce30c3f2dc9ccf383d78b47d2bb85ec44415f170ea5339faf44166641ede585ead28daf37664e80d4b94e7e730c337ae4e645b80ceed89dcadcbb52d150d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1.1MB
MD54293b04a4efb52e4feb3cd1e7519192c
SHA18bf7b8e21e4cb00d376452e1b466b09f69e20155
SHA25642fa71c8001cb7b7f60393b2bd6cf4cf6982e7e39c86579d9b52646e0304a6ce
SHA51270de945415a1df3e64c65260b565148002ad5171accabada27cdb95b390fa7c320ec7be0c1b255fe7adf47c3181deebb0825f0dc008feeff6e81eee8c9c1e28b
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
18.1MB
-
Filesize
4KB
-
Filesize
18.1MB
-
Filesize
18.1MB
-
Filesize
18.1MB
-
Filesize
18.1MB
-
Filesize
18.1MB
-
Filesize
18.1MB
-
Filesize
760KB
-
Filesize
760KB