Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 03:05
General
-
Target
0c77f542d062150e9a3216cb0b71efaf.exe
-
Size
399KB
-
MD5
0c77f542d062150e9a3216cb0b71efaf
-
SHA1
760cc7d3d09702f38e1193e312f218115fdc2d0f
-
SHA256
d3aca76694eff041d62a71a7d63c2810f6702023e8862b71435dd049e65cbc05
-
SHA512
4141a0c20b11066b05caaa8bd53ee7d0105e5a6b0382f04535dcf8cc7f15d26e8f7520bc596c3d393d2c3720d50ff4f5ba4a45c3c0866f06a72f7048f1da2494
-
SSDEEP
12288:CRFgXpS9r7HqIBBoxV4GDC+gl3/SSJR5+:CAXMB7He4qglPSm
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c77f542d062150e9a3216cb0b71efaf.exe"C:\Users\Admin\AppData\Local\Temp\0c77f542d062150e9a3216cb0b71efaf.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\dMdNbEc16633\dMdNbEc16633.exe"C:\ProgramData\dMdNbEc16633\dMdNbEc16633.exe" "C:\Users\Admin\AppData\Local\Temp\0c77f542d062150e9a3216cb0b71efaf.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27KB
MD535c2cfd30b28059a0148755c6f6f5ac0
SHA1626ba083026efa7312e8f7dd111d4b278c22eefa
SHA2565a10a1ffb223f1285d03223178236f50fad9d608884b183ff0e824ab92504cb7
SHA5128abc34e10a5a9d50e2faa7604b400ca0538422ac2d47baef4a946e119e05d4250b4125d2c8fa5ed52baaa4f969286c905a38c67955ecf6d8c188e6f2ff9247cd
-
Filesize
38KB
MD59c75ae0f1da3e67383d969773b85ce38
SHA1dd1f847f8b49b009ddba2641c78896f869ca1bb5
SHA25622a944973d4bf441bcc4d1ddc3448fa805672d0faf6db7ca93e194e45a263985
SHA512c8fbf5683d6ea7e1860e899bb45d2198f01e406a93b636c5e46d3d3ff78d52ec47e76d2c3593775bdb0ec7dfe4e0f488099e1042b066216a89e25d1acf22f825
-
Filesize
162KB
MD5dec978169e1cf1a0e2ce1d2112008f7c
SHA1993b4acc6bed79d37f04d8ef85b957bef536ddb0
SHA256864d9af49c39d11a7fb3e35b553348276cfe8e58c9810d653b16f2ad7371d557
SHA512a727ce42b79a848a1579956699bfe7f19f46d51256f8175d965cb6eda7b52895409783d525e42627cb3505a709716bc845d6361f120c106023bb77cc1ea23e0e
-
Filesize
156KB
MD5186ed32598caab54ad8b78b3e1ed04b8
SHA1d9952554b8439815f450b55a11594a89753d7cd5
SHA2565ebeda1ca8c8f9aa8295bb9ab791b42c8cb402713f824b25dc064069d067147e
SHA5123a95981a663f4fa47cd20e5cd18930369933f19037e50c07e9e53196df4d2af2015c64cd5aaa76c54f2450614ffee60a2b5c494664934d1d8f1e5d44b9e6dcf3
-
Filesize
172KB
MD52c362fb8bf06e14990ff8c41a87adb3d
SHA11d04d024e6f96035c2a3b7693eae338704bc66e7
SHA25634b3c59a45147bc96f13a3555bd511a492e68ffb41a955b0bbb84fff120b95b8
SHA512c4cdd9938981965cf3daa3f290b42241922b61878f14b7291781abc82cb57169668c80882c20d7dd43bd07931d9d5fd1c992cf6c90361961067eaacb3d8795c1
-
Filesize
1024KB
-
Filesize
728KB
-
Filesize
1024KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB