Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 15:12
General
-
Target
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe
-
Size
167KB
-
MD5
11442c43bbe7810c91a58af6d92ac810
-
SHA1
027d4ef6a11a59ca7588a6a3eed0b4ee368206a5
-
SHA256
75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76
-
SHA512
9fef88249f11afa4bc057bbe095114273e68e962ab015b89648b0708d1dee6e822a0e0e209512ad6d9fadc57cfe1d6fbfa54a13c4e1bcb59a8881cf1fd7a64f2
-
SSDEEP
1536:XWF0Tz+2x+/m2x+kDgJF+2x+/m2x+kDgWGekNsGekNFuJGekNsGekNRl:VTz1+l+kcJF1+l+kctphp1
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe"C:\Users\Admin\AppData\Local\Temp\75342ada938ea71dc863ee603a075a3ff7cbd759a091879f065a849650097a76.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2928-0-0x00000000009A0000-0x00000000009D0000-memory.dmpFilesize
192KB
-
memory/2928-1-0x0000000074530000-0x0000000074C1E000-memory.dmpFilesize
6.9MB
-
memory/2928-2-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/2928-35-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/2928-36-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/2928-38-0x0000000074530000-0x0000000074C1E000-memory.dmpFilesize
6.9MB
-
memory/2928-39-0x0000000004DC0000-0x0000000004E00000-memory.dmpFilesize
256KB
-
memory/3008-37-0x0000000003E70000-0x0000000003E71000-memory.dmpFilesize
4KB
-
memory/3008-40-0x0000000003E70000-0x0000000003E71000-memory.dmpFilesize
4KB
-
memory/3008-44-0x0000000002610000-0x0000000002620000-memory.dmpFilesize
64KB