Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
28-12-2023 23:08
General
-
Target
fee1fb8f43fe1f819e27c7829a2a5fc8.exe
-
Size
31KB
-
MD5
fee1fb8f43fe1f819e27c7829a2a5fc8
-
SHA1
ac7fb63dcef728f7098fc6df0accb162191894fd
-
SHA256
d3a8aebad829f66f1ec2846127c6fa9dc9851917bbc05e91620bcba3c032f9b5
-
SHA512
2c83d49f9bb9094a0717754a22e06a6cbbc685ab2d8d722a1e50105cc918634162c77d295973b0fd2de9edfb01f4e7ff08ac2c3e68eb216a85c9d160e114c445
-
SSDEEP
768:GMJmO6KrRQpMFrZREjnpE2SWnJrlLxqha5f:GMJf6KGkZRE7BnJpwY
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fee1fb8f43fe1f819e27c7829a2a5fc8.exe"C:\Users\Admin\AppData\Local\Temp\fee1fb8f43fe1f819e27c7829a2a5fc8.exe"1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\drivers\svchast.exeC:\Windows\system32\drivers\svchast.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5fee1fb8f43fe1f819e27c7829a2a5fc8
SHA1ac7fb63dcef728f7098fc6df0accb162191894fd
SHA256d3a8aebad829f66f1ec2846127c6fa9dc9851917bbc05e91620bcba3c032f9b5
SHA5122c83d49f9bb9094a0717754a22e06a6cbbc685ab2d8d722a1e50105cc918634162c77d295973b0fd2de9edfb01f4e7ff08ac2c3e68eb216a85c9d160e114c445
-
Filesize
96KB
-
Filesize
96KB