Analysis
-
max time kernel
126s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30-12-2023 04:26
General
-
Target
0e6d9b5e4df3607811a555d4fafa2768.exe
-
Size
64KB
-
MD5
0e6d9b5e4df3607811a555d4fafa2768
-
SHA1
d09b3bac7d74843b746099a040ad7ebebd6444f4
-
SHA256
da2c871c43c9170d90191f4b952d2dfb0d2def9aabe8d4792b10c0f1dad1327d
-
SHA512
7a64ed610ca5d78fee218d72edc46d28e168fd2b635e972036ad821f3a10e9d402572ee133e2d752144d2791c5db8a5387e11d465acaa8b34edea75a3ebf98d6
-
SSDEEP
1536:5FpJ5FRZYNf2eUAkrilPFI+bgfaSJzc1wVAoqbJ8QqdM:5FpJVZ42fANlPFIagZJQ1wqXbJ8bM
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Loads dropped DLL 2 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 8 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\0e6d9b5e4df3607811a555d4fafa2768.exe"C:\Users\Admin\AppData\Local\Temp\0e6d9b5e4df3607811a555d4fafa2768.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD58705097bea2b661c6ae45035b4b82292
SHA181bbbfda3188c2193ed71be5955c173c6a78e81b
SHA25674e08056f9309b0ddfd354f9071a528050d7e4b6ba1123d1ec31eb25f089516c
SHA512944887e7cbde6f9f04c0f9ff3c8014a9e1ebaa459096fef67dfe432599602ccc0acd3887746f828e3e1f001ab75cc9eaf62fee3d68bbb6552844b9817b5fbcba
-
Filesize
1KB
MD5fda923135536ee97c655903a583486f0
SHA1a6daf9129200292e7d979550cd6870afde8ce471
SHA256ad47b95cb3be25319aa35fee23da3aef03eac9019b90c4cac0073fec04e3408f
SHA512d2077d027715d171fa73aa3786714084dec27e57410984776da72079977ba15f974f430dcc8f51434ca5547bc1567ccff29210fe8c8ae2a54d4b0ea963bdea14
-
Filesize
552KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
116KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
120KB