Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 16:28
General
-
Target
7cb4820cf4cdf6da34612b949b979c95.exe
-
Size
281KB
-
MD5
7cb4820cf4cdf6da34612b949b979c95
-
SHA1
df99f0410946fe99dab3004a8d41c8851f0232e8
-
SHA256
24808c8c5026c79ca0dfa979a0b1591d4df20cc67f95b251ae291e90baf6e42d
-
SHA512
5897b8601c8f80cf150425524d2f9fbf890acb28a0349ea92f245fbda4ff34fdb318893153a3c520ba727bf6ce2dec5999b16df002e2f5147816fdb3f4f154f0
-
SSDEEP
3072:R9ZNYpBPXgXPeeUaVfY9BI51P/DI9wabtli5JN2:RpGPXgXPemY9BI5BPaW9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 19 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cb4820cf4cdf6da34612b949b979c95.exe"C:\Users\Admin\AppData\Local\Temp\7cb4820cf4cdf6da34612b949b979c95.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\msa.exeC:\Windows\msa.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
362B
MD5628667d59e2d235cdc9b190c14cff475
SHA135c8d4d19dcd7feef43e8a89c9fb80c7b9e114b5
SHA256db7150687553e3cdc32e1127df0790ff0a8d94a179671e0c95180ac04f46100b
SHA512d56d9397517f26f268ec4c079c5f1059b1e206fa4cb239ab4dfc2e1517a56a3122d7068d718a9fd8410cd2b84018adfda130008c4edb2ad28e3baeab3adbd8e7
-
Filesize
204KB
MD506617439a09be3a6851127fa3642c943
SHA1bf022db97c4154759e230093b691816614e1cb6c
SHA25661b703d20a2753cb39e0e015b1288c47d9a1663d8bd445664d1408f6f87392a9
SHA5129a998b14dd1dc15882841231ba206f2f430bd59ec998e1a2a862c547e8c36cc17fcebfdd7066c4d7b2e1178e7721beb836f9e5da5288eacb7a93778421e15dcf
-
Filesize
73KB
MD576962d9fdbc092a614a39b0b320332d8
SHA1ce39a0d008357c69790686136dbf2ff92ecde35b
SHA2561a92446eb586c82d5a0fde67a2532ec24ae06a022fbcce2db9d9127ffabda5e8
SHA51263d5032e74858f5eccc184667f99978aa283692a38e7d51eae18eb387255210fe4f03ba1e68437d1a4a26e92f60fbc405b4b54ea177fb72da490b65de4e9a311
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
12KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
12KB
-
Filesize
420KB
-
Filesize
420KB
-
Filesize
420KB