Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
30-12-2023 05:12
General
-
Target
0fb5316f798d549ff4d452f3ad0277a4.exe
-
Size
386KB
-
MD5
0fb5316f798d549ff4d452f3ad0277a4
-
SHA1
0ec9704a39cda03d57718fbae1e3448835f25d56
-
SHA256
a86874ea069ab1334b01752cd81d5aa5857c9397b0a321e033b7dc853aba262e
-
SHA512
255d44a73c2f0d994e5b9c8b1e1b50b18369491e63d34db9a8fc68623237f2cd295eb78e89b56df043568a6f9ef2653fe68da95b6201a83628121c4070c5daee
-
SSDEEP
6144:cCHD2hB0WCqB7l+04YmQ71poL5Cgg2GaSppsBUdZeppRSA6G7F3tNyu:LHyhW4BxXmQ71pkCg2aSoaISAxPL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fb5316f798d549ff4d452f3ad0277a4.exe"C:\Users\Admin\AppData\Local\Temp\0fb5316f798d549ff4d452f3ad0277a4.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\oO05366OfAjO05366\oO05366OfAjO05366.exe"C:\ProgramData\oO05366OfAjO05366\oO05366OfAjO05366.exe" "C:\Users\Admin\AppData\Local\Temp\0fb5316f798d549ff4d452f3ad0277a4.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\oO05366OfAjO05366\oO05366OfAjO05366Filesize
208B
MD5e619511e90191d42111b5e1186d54032
SHA10c537dd1e1d32ab0648cb081550df392e8498831
SHA256121ae0ade3f00cc4b0f6be030d58f014918f0fbe35d37d36ec07ac91290ca9c9
SHA512b83e5925c9329a1496a615f94cc4496178529d56a9adef20e803931e90d6d0d8bc2b178c1deaf4a9fe13a0dc94a375398eb01c9aa4a7f29caa950f73a5160e8f
-
\ProgramData\oO05366OfAjO05366\oO05366OfAjO05366.exeFilesize
386KB
MD5e1e6a9f6d687f5497267b7684bfb1458
SHA1cba0b8755de77affd499c77c785c610b718b9c2f
SHA2560b7b5544d516d3ce59f79fd8eacdda140ba9c5075621a894ff50b49eb9a1ffa8
SHA5120104b4f66859dd2d147017f1e7181f00ad21f3cd7ee3b731e72335b22c4e211b147e5d4cbe5fe0b3499942b25dcd16fcb06ac449364fb93636d604c902faa089
-
memory/536-86-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/536-87-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/536-165-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/536-201-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2212-0-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/2212-1-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2212-2-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2212-164-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2212-196-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB