Analysis
-
max time kernel
135s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
30-12-2023 14:04
General
-
Target
1ae4a4a1d9dcff06410ed0fda9f429b0.exe
-
Size
386KB
-
MD5
1ae4a4a1d9dcff06410ed0fda9f429b0
-
SHA1
4a95e3e539077009cf01179d8d34fe125e4c38eb
-
SHA256
c17352323e3c1f366bb3e09fa8847d7a93083f1b5d66a561d6830252d0776ef5
-
SHA512
a972f5298daa75adbcd1ce0c8c6b95db92f65adbe1560651427fba0da13c06e48fc6ded60dca56c8b5fd4cd9ff943fd651672fdf3e5d5d8834b9aae35309b485
-
SSDEEP
6144:tCHDXhB0WCqB7l+04YmQ71poL5Cgg2GaSppsBUdZeppRSA6G7F3tNyu:0HjhW4BxXmQ71pkCg2aSoaISAxPL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ae4a4a1d9dcff06410ed0fda9f429b0.exe"C:\Users\Admin\AppData\Local\Temp\1ae4a4a1d9dcff06410ed0fda9f429b0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\nF31066MmImI31066\nF31066MmImI31066.exe"C:\ProgramData\nF31066MmImI31066\nF31066MmImI31066.exe" "C:\Users\Admin\AppData\Local\Temp\1ae4a4a1d9dcff06410ed0fda9f429b0.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\nF31066MmImI31066\nF31066MmImI31066.exeFilesize
386KB
MD5ba11c53dac2a587f06a0d8477af52f63
SHA123f94bf80a153a849ce1799c1e20772e926e5112
SHA256a2c6373cb87026413f61e048465f9bf703dc971865a04d34827226eef4c34cef
SHA5124fd71eb4f96a119760f31eed6bcbdbd08dc1ede37d5a207796f5c27c3ed7d752eed1fc3a8cb7592198c14509c92bc5e91604b7caccb80a43bd650697121272c7
-
\ProgramData\nF31066MmImI31066\nF31066MmImI31066.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2148-87-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2148-86-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2148-165-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2148-201-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/3044-0-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/3044-2-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/3044-1-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/3044-162-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/3044-196-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB