Analysis
-
max time kernel
157s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/01/2024, 12:13
General
-
Target
4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe
-
Size
536KB
-
MD5
ba87e864b94b3898b41f70784214ccd1
-
SHA1
a2e1f5ef52c5d3c187a1ba52f3d7631cedeb1e3c
-
SHA256
4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540
-
SHA512
84095845e50f71d40421efd9b5569ee0261be34ef59dadbf53c053470e2226b38353043fa75cf379745c566a17c3ee58cb2f384103cfa186ef1cecf134b89130
-
SSDEEP
12288:Nhf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:NdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe"C:\Users\Admin\AppData\Local\Temp\4606bea551670d84e212c22913a02482e0b6b7a7ced51ce8292429e8226ca540.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c723ee6856557f0bfd1cc5e67b553d05
SHA13a78610a0c88153d0f6f5b78640a6e6be4c00090
SHA256965a8fe70760f2e36dde21daabe53e847bb56c53a850e6e6cb37238cc9963281
SHA5122693cc09b2d3a63ff4ed2fb331a1e871e33317959da68b2e095ec986670f5aaba620d44be5e5d79c7471e8c642410ec7f3259452898dd4a4b2cc5e556d2f1bb6
-
Filesize
939B
MD58fae162548fda49d1fd8a343356c191e
SHA10a85f178464e461e566d827985974d379e434d15
SHA2562195f0b4a24a2ab39c72931875473d38cdc1d6d33eb9257072eea8c5052647d3
SHA512fbbe6dc04f4b583bcf441b160138ddeee81112864e784cdeb79256e1377f30732d58b2e450156899b02e35018a4a2075d8edce451fc3b3894aab77a336b06a92
-
Filesize
502B
MD516f75281b71c22c749f11c541033307c
SHA1094d351ec2308d5dcad5bc9da6b62ac74464c9b4
SHA25606f8303db7f6afa81b26925169737b083ac4249473ee94d7c2d201f6e95ea660
SHA512adeb2993d00fae40b3b9652af0ff93dd5e18c0f82a6e082abf7202d3cbe723c5a99c0984f990b4abbf194673b619b2147e267787ff7aa3f99cb663e6eb8fdfee
-
Filesize
520B
MD54b6d1a8d9c943b43fb86d8b47ece7a4e
SHA17ed85eff374f456fdd72543391fbbf7dde641beb
SHA256ddc19b8de4cd615b09a9664805ee32ced0fc3bb5fc4caff8bd0261181230d846
SHA5129a676b6772c02fb828329975c84cf67749c8c1b88062ec73ea1eeafb0c851aded785e283921ede453437b6a55dd99549cc014737d9ddf3550f539eb3df5473d8
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB