Analysis
-
max time kernel
191s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 01:05
General
-
Target
097e35acf6d7026d8794bb43e8df0e9b.exe
-
Size
396KB
-
MD5
097e35acf6d7026d8794bb43e8df0e9b
-
SHA1
29cbf7fd6176330952e3be1eb712428458d083c9
-
SHA256
ca0cf220d6ad198b5a5d2469666923d5d472f62abbd0eb7572f0bce734bb2ac2
-
SHA512
0539ead1f1b9c05262e50c7e8e45fc9c30feef3c628de37af30a8d1698ac72fadd0bb366e9d13acc32b7bb6ae4aeb44e7bdb4381b545447a91f0da69be59d680
-
SSDEEP
6144:+sUcjPG3DLLSYgIOH4gTS44udC3d9cVx54vEa3t4ywDikLA6V0zAWi+R:8cju3fuYgnYgOluI3vcVxSv79rmozxN
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\097e35acf6d7026d8794bb43e8df0e9b.exe"C:\Users\Admin\AppData\Local\Temp\097e35acf6d7026d8794bb43e8df0e9b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 6682⤵
- Program crash
-
-
C:\ProgramData\oL06511EnPlP06511\oL06511EnPlP06511.exe"C:\ProgramData\oL06511EnPlP06511\oL06511EnPlP06511.exe" "C:\Users\Admin\AppData\Local\Temp\097e35acf6d7026d8794bb43e8df0e9b.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 6683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4340 -ip 43401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2844 -ip 28441⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD5b29e103851768df90a1b48c39f34644f
SHA114a91fef4f72df23450cd98130f747a501dba452
SHA2565c6a8d4fc1ff568153707269f793780a638d00241f23ebacfc0e7a44210539ee
SHA51254ea68dc84d525ab4b3827679c2f629ec41f9198cfd8414911113d3e5dba0c5b77fda37947c65660cedde912ab1e4479cb2161a2238624e0e50228913ef4191a
-
Filesize
64KB
MD5b03c9b8aca08e711455bfef79d5fee98
SHA1a40227a4d95b7ada832242b2a4b05b59b171598a
SHA2564d2b41d3760fd2713e8a35f85cb0e23cb2e11e07ed887bac4e34546b9a6fb6c2
SHA512dc2f0a0389a404a50b1aa55956a619c210c12e8ffa4267c322fd1a2fc19e7f47d2c26b3a7641bc78a567dd3f6727cbd024c9bbe1d1abf7fd69b708508906b351
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB