Analysis
-
max time kernel
91s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 19:49
General
-
Target
3ae6b80dee1f42d945e9d16fefed6d8d.exe
-
Size
161KB
-
MD5
3ae6b80dee1f42d945e9d16fefed6d8d
-
SHA1
e52db7f461133ec85045115391c8574864929453
-
SHA256
5155b9b87652d05e1b6943c7f28aa0081b472e0456f21f9d087d1d1d65254f25
-
SHA512
3f3c64697bdf4a3f78c4e00940daf391e7e237509a4dbd1a7e5af9897ef60978553ceb488860123227c4b561673424d44c6d3b13ccbe51986df8d2ba10111abb
-
SSDEEP
3072:hwv/WFu2OIYNV/7Ua+R9cn2o43NzmXvoWDDGKjJWHZQKk9Sth:hwXW8nZ/ocn2oqNy/1hWc
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Registers COM server for autorun 1 TTPs 4 IoCs
-
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Modifies registry class 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3ae6b80dee1f42d945e9d16fefed6d8d.exe"C:\Users\Admin\AppData\Local\Temp\3ae6b80dee1f42d945e9d16fefed6d8d.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5bfa0c9ec67cd0f1b2dabfc7777aae294
SHA1c15a4686bda91546e4c3abba58530423c40da3dc
SHA256f3a8ac1721abb9068c5c281dafeaebdf3a66f96954c9e882ef71dee9c44bc585
SHA512e2e7b989e17dcf2f0c2b93e53671a6f34230b31b0daa152fd9ec84aa14055b1350960d5dbc7da02a03d4eda7c68f9082f6c8be053ec56c0bed5b2bd0ef38556f
-
Filesize
2KB
MD5d3a1d229ddf85ac1856f00413edc84a3
SHA13ffe01d8c259f7b2dd13fffc5d2335f96b579ea9
SHA25638c22c1185a8948cd0c7ba79bcad4e92f58977b50c8d1f2d263693783b4eac20
SHA512689f2e2a19199f8eb50466e32d28b7aae26e6ad92eabb3bab7775577bffb2faac0164b32df8a0c6be269943cb8b629dbd9565aed78319b2e72503a43b9e24029
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
184KB
-
Filesize
4KB