Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
05-01-2024 03:10
General
-
Target
429c58ff541cedd417bac381255df43c.exe
-
Size
12KB
-
MD5
429c58ff541cedd417bac381255df43c
-
SHA1
d0a07e34464ed721163fea9895c4b6cb425a365d
-
SHA256
53bf47a1f95a3fa29da9d84ddc76fe47750b2d334fd9e0a6a738d9137a447307
-
SHA512
63420f8d07172629e856d4632e2a3929912b1db1c1d2b3c2c0d30703a5c246f295cf5070312f3ad694685b1f5a4e5fa7dc30535a1fa97b104c36980a670ac3fb
-
SSDEEP
192:vtzVhP3zDgcPJAndzoS2/n2raIedJK5U54uaykB5YWfnD1Mky1i6wdpap:1H3vPBAGSA2/efKG5yy65L1w1VyY
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\429c58ff541cedd417bac381255df43c.exe"C:\Users\Admin\AppData\Local\Temp\429c58ff541cedd417bac381255df43c.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
MD5d0a2dfcb04638a437423ca40949d5815
SHA13e887057a38eee2f6d83dfd898bef9d82922daae
SHA256a4404a13612b15a8ca8ef23a9a0acd8b79ef0316776999d887f63386240e8c75
SHA512176e92b2efbccff4a6368feb25b4b0624451b26636ef551f2640fad52af4a0276aa2d5d2f7d69ff3486f996082de7b6ee8225eb738e729751f0f8802de969b9f
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
36KB