Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 21:33
General
-
Target
1d203bc511e64a8f9a40010595dfb5df.exe
-
Size
190KB
-
MD5
1d203bc511e64a8f9a40010595dfb5df
-
SHA1
8a4dbf3c4367a67b2655c65ff4897d9496b4e6ef
-
SHA256
18b2069118ac058b90cb5f1e7afd220d5ee44cbddebfaaf411d094d90a892268
-
SHA512
64f510b23a6fecc597145cdb4e871dbdc7d2d776a8322ea30108d7c7c02e24eefe9af514c3eae6684851d9cf357e672543999a4d914852f4d4137eb1738d4ccd
-
SSDEEP
3072:5tY7o4FYVdPEbWy3KCPS2KhBuO7hgFdagOaHtamDYQ14TRsS5In42LwQObw6UzgT:5z0Ud5y3/S2iB57hgFAgRHNYc4TRy4eC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d203bc511e64a8f9a40010595dfb5df.exe"C:\Users\Admin\AppData\Local\Temp\1d203bc511e64a8f9a40010595dfb5df.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Sviqua.exeC:\Windows\Sviqua.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
190KB
MD51d203bc511e64a8f9a40010595dfb5df
SHA18a4dbf3c4367a67b2655c65ff4897d9496b4e6ef
SHA25618b2069118ac058b90cb5f1e7afd220d5ee44cbddebfaaf411d094d90a892268
SHA51264f510b23a6fecc597145cdb4e871dbdc7d2d776a8322ea30108d7c7c02e24eefe9af514c3eae6684851d9cf357e672543999a4d914852f4d4137eb1738d4ccd
-
Filesize
344B
MD5e5ccbd3b00066abce40fc4b24df66368
SHA137f45d53b4c8e03c9241c1e3fbdb1ce14a60bb63
SHA256a934005d3f42ad1262fb6e2b3ffb442220c9f201c0010d7e710580ed2a9d2c06
SHA51272b882bc33ef6fd80483af0ff2c56804ed376fa281de326283668ead9371725b8167aa207e68de98cdf381746878da0e40a1da2bdfa3e55a88bb403210224c05
-
Filesize
396KB
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
4KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
396KB
-
Filesize
396KB
-
Filesize
244KB