Analysis
-
max time kernel
54s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03/01/2024, 22:21
General
-
Target
3f2c02e9bb04f1248e924bcbab2066d3.exe
-
Size
204KB
-
MD5
3f2c02e9bb04f1248e924bcbab2066d3
-
SHA1
61a8a2ca589e95310520d93171d427c9822bd8a7
-
SHA256
920d54aaeb5401f263eb23cab18d846596e1df48bb3b7c75d68303a9e068eeb4
-
SHA512
23609518c9d9c448713c2ae725b7711583e1473b40dbf22478703213d0ee7b842ed86f5166879da0582f69eb0508e7d1573bccb9697c42f3867e2e4aae884c6e
-
SSDEEP
6144:qLlUZNPSMBiq9n/QGjFwcAVhBYOmOa5HyjhCgDooSr:uOrBiInomybhsH2hnooSr
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f2c02e9bb04f1248e924bcbab2066d3.exe"C:\Users\Admin\AppData\Local\Temp\3f2c02e9bb04f1248e924bcbab2066d3.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\87i5vxx1.exe"C:\Users\Admin\AppData\Roaming\87i5vxx1.exe"2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
162B
MD54f8e702cc244ec5d4de32740c0ecbd97
SHA13adb1f02d5b6054de0046e367c1d687b6cdf7aff
SHA2569e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
SHA51221047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f
-
Filesize
204KB
MD53f2c02e9bb04f1248e924bcbab2066d3
SHA161a8a2ca589e95310520d93171d427c9822bd8a7
SHA256920d54aaeb5401f263eb23cab18d846596e1df48bb3b7c75d68303a9e068eeb4
SHA51223609518c9d9c448713c2ae725b7711583e1473b40dbf22478703213d0ee7b842ed86f5166879da0582f69eb0508e7d1573bccb9697c42f3867e2e4aae884c6e
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
80KB
-
Filesize
256KB