Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30/12/2023, 02:39
General
-
Target
0bf37a2e303b272bfa457cb81fda60ee.exe
-
Size
384KB
-
MD5
0bf37a2e303b272bfa457cb81fda60ee
-
SHA1
5c7f6afd35e9818458aa54dcc58479c0d34a45eb
-
SHA256
9fa06fcf8defc5d8fb7bcad83587d21e829358f64b6ac53bf0641c02bb47f52b
-
SHA512
6d7cf132894666958856b13f1c7befccebd935ee419dca38c9797d28305e5a55af2fd3faf9ae5b99583da728d2fcf41d6257fff3e083afebddff1d72a2a9d508
-
SSDEEP
6144:qHRpFfAoY1GDFalhVMAPthi/dJ8cD4L7LFkxfhmITTdHurgy6bav8YpMB:4YeDFMhOmhi12GfTFHugy6QMB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0bf37a2e303b272bfa457cb81fda60ee.exe"C:\Users\Admin\AppData\Local\Temp\0bf37a2e303b272bfa457cb81fda60ee.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\cC28321DkBfH28321\cC28321DkBfH28321.exe"C:\ProgramData\cC28321DkBfH28321\cC28321DkBfH28321.exe" "C:\Users\Admin\AppData\Local\Temp\0bf37a2e303b272bfa457cb81fda60ee.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD53f3e677012e15113744f411f35840cd6
SHA1e0c6a51f3127734b884503e07c8fab74dbbed1b8
SHA256d69e9ec0ccb8c8a006debb354f5db071a47f44123223b933e2ffe46b9830ade1
SHA51206581a08668e7f40313c50e81129c98c6e9123cc3d8a1c3cd679a1dd5c2b2d3ce31aa473dcfb8429c85c475ce2e9dcd6ea1395af3cfc28359714e9590e37af2a
-
Filesize
92KB
MD5873730e466084e3c1b6f8a05182b9e4a
SHA1d4312ca670b84f888ab322568eaaec934e201c5a
SHA2569640ff95d44d7f0e8970ca3ebe7ea55128426492b6e8e62c1774d4811b987969
SHA5125f8e09a28abe63ca67e49ade0605ef8adcad1d1b339eacc334fab16b94f49f3d97dcfeb99ac3276a26374957c52ec69a4341020cb9e9c250dab6ac1abadc5440
-
Filesize
384KB
MD584098c9149e8b1bfac88c4e7f123be2e
SHA1608e4d7b7c9859b742f887fb069c0706e9d2ff16
SHA256a935745bc95a9f276cf875a5ba027c2d936b46195851ce210a237ec85b7ed6ab
SHA512923d5429332674f0fcc9fc3edb607500b6285bd72d420b57bb707f58c83664c842dd56544457a69f1575caae35bd8e7b2617d2c5d1e07fe5cea425a0a2899d66
-
Filesize
8KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB