Analysis
-
max time kernel
136s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 22:21
General
-
Target
HOTFIX/KB842773.exe
-
Size
725KB
-
MD5
6efc8240302b4cfe1fdd0a990852581d
-
SHA1
045e580d1d4f3009955746d315d5e1681809950c
-
SHA256
1e05f13490a252dd34b4ca73e40432968f4b634b4cae5a4653a0debc47995f5b
-
SHA512
f7c0dde227199051d9757b32e7b72712ce29ff7a76b120d4bc844ccacc2ddbfcbb2410d5b729475894ef552fe046c42b95aef584c3ca0458fed223ed957acfab
-
SSDEEP
12288:lGfimaK9/vCq6YDOTZ2J8Giq/4OC+leGZOjLOl76WdOBmFkwWX/MmbCU:l4iY9/vCzbsoqAB+kGZOfO1fOMFkwWXX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HOTFIX\KB842773.exe"C:\Users\Admin\AppData\Local\Temp\HOTFIX\KB842773.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\a25b97486a809b0875c9cd\update\UPDATE.EXEc:\a25b97486a809b0875c9cd\update\UPDATE.EXE2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5ee207e35aea4d5df41d90221e1b66efa
SHA1757469cf9ad2f21f267bbe730560114fdf8a89a5
SHA256cf64c95e9a2d02967efc22b00efb3736156b913a95231eb63c1df45d43475e64
SHA51243e9f75725daa4f3428b2d9cee2c2cc8b2f2e991b8e58d72d2f429fbdfb614c86d172f03d3f9da98756bd4e245643d9a57c6efa422d6c60ad364a2322245542d
-
Filesize
67KB
MD59033662752c1da831aa5f90d57702eb9
SHA1bd76619acb45cd02cf9f8250b0d35b77bed45706
SHA256230fb9874e7589aa8e1ebf65ab75d5471440cf204ba4fb81ded2d90a1048578e
SHA512d4a51c84531b5e562f0378c491624d7561bc8987396027bf8a551d8d667aa412f6b2b2f0249a4b8dc7e27708d0f883b8ad582708f77f3bab25d8211767bfb442