Analysis
-
max time kernel
361s -
max time network
363s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
01-01-2024 14:39
General
-
Target
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe
-
Size
276KB
-
MD5
80d0e4499a2ce6ac1d3bd1d43300c506
-
SHA1
a1ca861aacf0ef8369d7d5a169134c29f895e5ef
-
SHA256
67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10
-
SHA512
e67bab4f57deb5f3cb6a227298a19c9f6d96ef0e6825be0ef9f1f3537ca7cc32e9ba4482a5f6e2240b0d6a15ee39061671d6d4928afcfb7feab09009d5e44d30
-
SSDEEP
3072:L6ZBn8Tiju3y8TBz5c3Px/rbtYkHOG0rpPVuwq7fxZ1v:gaijqNcpqful
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe"C:\Users\Admin\AppData\Local\Temp\67bf260c3ea1e11df9c162b370cb5182d6d9d66392d90f11729c90e911404c10.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
-
Filesize
304KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
256KB