Analysis
-
max time kernel
134s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 01:09
General
-
Target
82de6da5a0e98e6535ec9375679c22a7faf31e200e1cacbb905a3d36736c4f26.exe
-
Size
514KB
-
MD5
fd265d88bb9641b04158db462a49f767
-
SHA1
e2d871ef3c661db795ea8ba87e3d1a985cbc4fe7
-
SHA256
82de6da5a0e98e6535ec9375679c22a7faf31e200e1cacbb905a3d36736c4f26
-
SHA512
47318350af7a9956ea4dd0cc6ffb38688a18b68567a2ad09349928a44f4cb44c2193f6474a3613ba1c9535a107d1d663b5b20bdf8a3d99b4ecdfc40adb8d3930
-
SSDEEP
12288:1r4W0saArLbkSO0hKH+l175ivmgxJIWyEjYgPv:10BsaQkIKH+WfX/vEgPv
Score
8/10
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82de6da5a0e98e6535ec9375679c22a7faf31e200e1cacbb905a3d36736c4f26.exe"C:\Users\Admin\AppData\Local\Temp\82de6da5a0e98e6535ec9375679c22a7faf31e200e1cacbb905a3d36736c4f26.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ie6wzd.exe /S:"C:\Users\Admin\AppData\Local\Temp\82de6da5a0e98e6535ec9375679c22a7faf31e200e1cacbb905a3d36736c4f26.exe"2⤵
- Manipulates Digital Signatures
- Executes dropped EXE
- Drops file in Windows directory
-