Analysis
-
max time kernel
2s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 11:36
General
-
Target
bcc726f74726c3f6c784d6de9b9c13d4cb6ca96e248b2fa41b10049981f964f3.exe
-
Size
536KB
-
MD5
61aece6ec6fe08c9c39f27d7d49d7e3c
-
SHA1
683006c1b4f0c5a7c95b126e7a6311cd3a6d9cdc
-
SHA256
bcc726f74726c3f6c784d6de9b9c13d4cb6ca96e248b2fa41b10049981f964f3
-
SHA512
b89113d97cb5ed0f6e6a57e05e4a6f599ca8abf843a2650f753e88da6034dfc8b1f092c9778e91d3ae14e359b1bea5ae41dad3cb7a2cfa71519806d641429ca0
-
SSDEEP
12288:Yhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:YdQyDL9xp/BGA1RkmOkx2LF
Score
7/10
Malware Config
Signatures
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bcc726f74726c3f6c784d6de9b9c13d4cb6ca96e248b2fa41b10049981f964f3.exe"C:\Users\Admin\AppData\Local\Temp\bcc726f74726c3f6c784d6de9b9c13d4cb6ca96e248b2fa41b10049981f964f3.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB