Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
30/12/2023, 11:54
General
-
Target
17aa6c331f37864c7d9087b12935d503.exe
-
Size
468KB
-
MD5
17aa6c331f37864c7d9087b12935d503
-
SHA1
1473a25d14becc75df530d99b1e14b6370d531cb
-
SHA256
97c5c20c5a25cec986fd23a691cab7aab8901c516a32e715953b9668534fa205
-
SHA512
aae581b2b05dc3860e79b3ea1aed20bda357e14225729b3fd7eefe26e3ece0a8641329549043b5aa24664b94ccef1629d63dcb3a1a2134f08033c2d36bc6835d
-
SSDEEP
12288:7m+KEloUcYavtVQE5Cf2gqitRssGCwWtUVJuv0:7WEYYa8E5ACizfUOv
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\17aa6c331f37864c7d9087b12935d503.exe"C:\Users\Admin\AppData\Local\Temp\17aa6c331f37864c7d9087b12935d503.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pK28601HoAeO28601\pK28601HoAeO28601.exe"C:\ProgramData\pK28601HoAeO28601\pK28601HoAeO28601.exe" "C:\Users\Admin\AppData\Local\Temp\17aa6c331f37864c7d9087b12935d503.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5f124a0a2069364d763004de9f3a86024
SHA154db6a88208209e398b7ebb10d04882911c132f8
SHA256a35832bf4a34e3284aef90c2dee124a13a0f0f667abbf89e301b72d015362eca
SHA512ca4159c8ce234469eb52b32155b08f8909f250b69d7f5693247a507566542adf3155b099c19fbcbc4af953a3b796fefcd8416ac0fd78c8a58a7f158f1670ff5d
-
Filesize
92KB
MD5dc381d658da63eaa58313adcb7b10777
SHA11094374417921e7eaf3bc9502c524360da1d9995
SHA25678c47b7ee5b4c5edc4150c3f61d3b9552e405ea2bdadbbf11e7bc0151d15347f
SHA5129a68d75f25cfcacd1b0b345b721f1a689d09635948f99ec1fa68dcc0c1a8cae990fd92d40781a03e4cd992a8991a44359ce47b7c58b90461117f07971aae642e
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB