Analysis
-
max time kernel
121s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 23:10
General
-
Target
1f8bfdf427b6afa99a60c0d907bbd35c.exe
-
Size
496KB
-
MD5
1f8bfdf427b6afa99a60c0d907bbd35c
-
SHA1
bafb13d0635320fd4335bb584e08c656cdc89085
-
SHA256
1d60a629b0d6b3f574a7f2450146f7ce440fd5efa827af2b3ca36fbb5d7ba429
-
SHA512
e9c37ef9a4e7a929427ba16899272dd47927539f2f703d1dc30fe149e26ba6e0071343c88e917d072a2595cb36ce28dc0a29ff1f7ca16a8c31cf4a8f44bbc7bf
-
SSDEEP
6144:Lv0hed0DtN2JEJlOynVscJFfqRZsmCEtjpGsdjJQVJf6xx5L67:L+75VscLcZXDdjun6v5L6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f8bfdf427b6afa99a60c0d907bbd35c.exe"C:\Users\Admin\AppData\Local\Temp\1f8bfdf427b6afa99a60c0d907bbd35c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Mcakia.exeC:\Windows\Mcakia.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
496KB
MD51f8bfdf427b6afa99a60c0d907bbd35c
SHA1bafb13d0635320fd4335bb584e08c656cdc89085
SHA2561d60a629b0d6b3f574a7f2450146f7ce440fd5efa827af2b3ca36fbb5d7ba429
SHA512e9c37ef9a4e7a929427ba16899272dd47927539f2f703d1dc30fe149e26ba6e0071343c88e917d072a2595cb36ce28dc0a29ff1f7ca16a8c31cf4a8f44bbc7bf
-
Filesize
344B
MD5186d2cb2549f5610e57f3b51833ec9d5
SHA1106f605f3f9b268d8070ef7cb814176ae0312e73
SHA256dc850b0259990f210ee2d7796c2c93a28ac62319d5fc379adc5b7306a15d8850
SHA51250444c6e8e03c3c274905e02315995129364903b3217207e02326f87b5e1493d90e7ba8315cfa727428b0e163166c548f337663dedb9771506696ffa73a1917e
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
504KB
-
Filesize
504KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB