Analysis
-
max time kernel
67s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
31/12/2023, 14:40
General
-
Target
16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe
-
Size
536KB
-
MD5
759aac2d106f797f4ee6ac1dffb117f1
-
SHA1
f0abc1820ba698b33a431c03133a852be69881fe
-
SHA256
16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265
-
SHA512
3138e01ef92d7fa3275f24203f8d667ea5862529ed654b9f3473699b5841d528fb12d290e8ce1f68ebc4643a32befc242ea79edc324ce24497a567f240963f4d
-
SSDEEP
12288:Fhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:FdQyDL9xp/BGA1RkmOkx2LF
Score
7/10
Malware Config
Signatures
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe"C:\Users\Admin\AppData\Local\Temp\16f1d56d532250407ac134d50a419ce3d55b61ba037797be96a7970146910265.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB