Analysis

  • max time kernel
    213s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 03:44

General

  • Target

    0d5caf48a3cf783c51428b094b5d3568.exe

  • Size

    464KB

  • MD5

    0d5caf48a3cf783c51428b094b5d3568

  • SHA1

    710268bc0032cd0b0663cbe8f3bccc3fd4827fbb

  • SHA256

    27e80e73706a8ddcd492fb0753f3a300b993de979c6273c2943d9740c158f842

  • SHA512

    f994bdfd6266fc5131d7f4971002931cba2ab84969d98ec21f07dfe3cd4c89b9fdb30b5a5c60c9f456cfdbee1a070cbb87fe7ec0cafe24612f7763b4aaebdc4a

  • SSDEEP

    6144:bO9dpc00ImYIhkj9xr3jL01F55kB90c3PB1RjNj+1xVhaho1ZkXgyAfS9Aalewa:a97h0qIU9FMAnZ1RB+xVhaLXg2uL0

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 5 IoCs
  • Disables taskbar notifications via registry modification
  • Windows security modification 2 TTPs 8 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • System policy modification 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d5caf48a3cf783c51428b094b5d3568.exe
    "C:\Users\Admin\AppData\Local\Temp\0d5caf48a3cf783c51428b094b5d3568.exe"
    1⤵
    • UAC bypass
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • System policy modification
    PID:2628

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2628-0-0x00000000003B0000-0x00000000003B6000-memory.dmp

    Filesize

    24KB

  • memory/2628-2-0x0000000000690000-0x0000000000693000-memory.dmp

    Filesize

    12KB

  • memory/2628-1-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2628-3-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2628-11-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB