Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30/12/2023, 23:39
General
-
Target
204e970f9730464fefe3dbd984697fd7.exe
-
Size
501KB
-
MD5
204e970f9730464fefe3dbd984697fd7
-
SHA1
3751cf14e10f9e58cba4a2c3e488499dcceda057
-
SHA256
e7432c4bbd650bf0adf901103d7e5d5b535c4c4ffd32edd362baac5a444c8841
-
SHA512
6f9f904d988319e46a51041a1bddb68082d6b6ddc1f6a23705daacd95ed54c4f71016b00873414590a606916601f42c44e9a0ad26b7f056111ae013f7aed8e8a
-
SSDEEP
12288:juXFcrQVuGYz+7vjvkVa/JWVQUUUJG8XnrxAn70Fu6:6ckAs9JWiUo8XNqL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\204e970f9730464fefe3dbd984697fd7.exe"C:\Users\Admin\AppData\Local\Temp\204e970f9730464fefe3dbd984697fd7.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\mA42900EfAlK42900\mA42900EfAlK42900.exe"C:\ProgramData\mA42900EfAlK42900\mA42900EfAlK42900.exe" "C:\Users\Admin\AppData\Local\Temp\204e970f9730464fefe3dbd984697fd7.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD570182e35942b6183a3a14b4418da183b
SHA179abcf4e7fe2bb8fce25fbf9e3e6742ab947622f
SHA2568c23fb89b9d6d153b0c7ab851453fa969f6df9741422b2b9d94dda8fd4ca3216
SHA512e8f5ddd76cc0e3860a56a7dc7203b8148eb824c807c012302ce5169e2ede2844ae43828a5df1a74d0862ffc3fe86924f26ccc06bf2433c2aeb2db9b81372afa7
-
Filesize
501KB
MD5a1534ce9c152eb7aa16ae4d99e9cc80e
SHA129f787e41dd7812029c5558f87b427ebb6fac864
SHA256e3a3578c4df9d5dbe1db6d5d6779595b07f96e7c795f2939339c9f5ab0df35a5
SHA5120a637859aa6e4f030a2a52fe4401eb74255f15830109d9a7605eb831190180f9d6452cf62a034a9d36e8a38bebfa4c18981893cdd8f1100cf3a25c38a5a80bd2
-
Filesize
828KB
-
Filesize
1024KB
-
Filesize
828KB
-
Filesize
1024KB
-
Filesize
828KB
-
Filesize
1024KB
-
Filesize
828KB