Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
28-12-2023 22:00
General
-
Target
fb3d344be065453c0cbe0d477b1c8fa8.exe
-
Size
195KB
-
MD5
fb3d344be065453c0cbe0d477b1c8fa8
-
SHA1
39f5f09feba7b5badec1063ae459fe0e0522b1e0
-
SHA256
44f105d64c55a8773bb2a9ede81646f8b79503ec15eea7560990fa132d79ef76
-
SHA512
011406d4ef23135300ec3f718a5b43300fdcc6bad0ec19c99623cd8a0bcee562efd0efcbf4881237652df31f88d9191bddd068ff2dbb4088d290e3464413926c
-
SSDEEP
3072:qJg93A/BYtsYUG214enxLQVYFKEtgU//r23uV13MBhIog+rMbZBOGSqszwQu5CiQ:b9Qp0lz2yceq//pM/I0rXN1wQu5Cp
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Registers COM server for autorun 1 TTPs 3 IoCs
-
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb3d344be065453c0cbe0d477b1c8fa8.exe"C:\Users\Admin\AppData\Local\Temp\fb3d344be065453c0cbe0d477b1c8fa8.exe"1⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB