Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-01-2024 15:12
General
-
Target
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe
-
Size
168KB
-
MD5
858f74b2c777c086eaa36d9cfd4f38d2
-
SHA1
ccc4e31495008464118c71b55e27ace1fe35736f
-
SHA256
87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e
-
SHA512
c30e692885aab0bc30dba82a1ee6037b25de56027fb06564062991713e9f062c2b5d9fbcdd802aa0f7503b1ea8942bd9641b7b2299b4e341aa5f41b4739af0c5
-
SSDEEP
1536:R9vtiz8f+2x+/m2x+kDgJF+2x+/m2x+kDgWGekNsGekNFuJGekNsGekNcl:+8f1+l+kcJF1+l+kctphpS
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 13 IoCs
-
Suspicious use of FindShellTrayWindow 29 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe"C:\Users\Admin\AppData\Local\Temp\87f2db714eac44b77889c850b8b6b55e2b117c88ac8f8923b47ac89fecadab7e.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2396-0-0x0000000000170000-0x00000000001A0000-memory.dmpFilesize
192KB
-
memory/2396-1-0x00000000749F0000-0x00000000750DE000-memory.dmpFilesize
6.9MB
-
memory/2396-2-0x0000000000380000-0x00000000003C0000-memory.dmpFilesize
256KB
-
memory/2396-43-0x0000000000380000-0x00000000003C0000-memory.dmpFilesize
256KB
-
memory/2396-44-0x0000000000380000-0x00000000003C0000-memory.dmpFilesize
256KB
-
memory/2396-45-0x00000000749F0000-0x00000000750DE000-memory.dmpFilesize
6.9MB
-
memory/2396-47-0x0000000000380000-0x00000000003C0000-memory.dmpFilesize
256KB
-
memory/2740-46-0x0000000003E40000-0x0000000003E41000-memory.dmpFilesize
4KB
-
memory/2740-48-0x0000000003E40000-0x0000000003E41000-memory.dmpFilesize
4KB
-
memory/2740-52-0x0000000002750000-0x0000000002760000-memory.dmpFilesize
64KB