Analysis
-
max time kernel
147s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 18:28
Behavioral task
behavioral1
Sample
0x000a000000015f7a-20.exe
Resource
win7-20231215-en
7 signatures
150 seconds
General
-
Target
0x000a000000015f7a-20.exe
-
Size
202KB
-
MD5
5fdd418baf9c0d789e67758ad9f2dd1a
-
SHA1
c0be3be193af670cfe01a64aef7c5b0a0b9d091a
-
SHA256
82f59d1a1a65c0651ae7a965bb6481ba1351ea9efc9f9457de372043709e5a47
-
SHA512
9ace7aed4e4db6f2df7a8df22227079acf176cb7b7e90a0d2638dfd44296653fae6194531a7335fb10fd9396f3cd4f11621715b2a2e4f948209055a809b00c50
-
SSDEEP
3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIdQfO32vT/T6BQ1bxjOhdiinv1:wLV6Bta6dtJmakIM5JfO32vTj19B+T
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Monitor = "C:\\Program Files (x86)\\LAN Monitor\\lanmon.exe" 0x000a000000015f7a-20.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 0x000a000000015f7a-20.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\LAN Monitor\lanmon.exe 0x000a000000015f7a-20.exe File opened for modification C:\Program Files (x86)\LAN Monitor\lanmon.exe 0x000a000000015f7a-20.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1984 0x000a000000015f7a-20.exe 1984 0x000a000000015f7a-20.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1984 0x000a000000015f7a-20.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1984 0x000a000000015f7a-20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a000000015f7a-20.exe"C:\Users\Admin\AppData\Local\Temp\0x000a000000015f7a-20.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1984