Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29-12-2023 18:09
General
-
Target
001531dccf5d0762b2de9cfc79b7672c.exe
-
Size
54KB
-
MD5
001531dccf5d0762b2de9cfc79b7672c
-
SHA1
7e2c760695dcc59a0a57d55a25089154bd55a811
-
SHA256
52e90cd3377d1c20f529cce5a94a03c83a8d8196df6dd1ca062a76a16196b21f
-
SHA512
57a7be11309a7d3e682b38f93f6a9779cd1db5877a6e46573877a00a9f48a9f7505c9b9ec529bd9a28b644261fb677bc8bf64000702a2ec04a6a98c8d550792b
-
SSDEEP
1536:ZXlqeEo6JeaFRSfXBYO7ifRkB+HFECKGRv:ZXlqto6gy2XBYO5BkFESR
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Kills process with taskkill 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\001531dccf5d0762b2de9cfc79b7672c.exe"C:\Users\Admin\AppData\Local\Temp\001531dccf5d0762b2de9cfc79b7672c.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB
-
Filesize
104KB