Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    07/01/2024, 19:37

General

  • Target

    a83dd75d61102086fcddcbe2b48f644b.exe

  • Size

    96KB

  • MD5

    a83dd75d61102086fcddcbe2b48f644b

  • SHA1

    50e77ec55243e76e2ceaddf5930712f1962c235d

  • SHA256

    16f701f6662d98652f659d35371e60765a64035a81f1a92a1c0fdc2e67d3af69

  • SHA512

    509b80c66264dcb15b9b4b60e93d52d52c2b79fce94da1a3a010f0c040d15a049e5830bbd2341ec6875db1666e32d79b606bf38df5f9f2ace8a3af6b2c3218cc

  • SSDEEP

    768:IBd4Xon6LgLa1fmTZTPXqI5zUDO6SaQIKhAQ52tYQ4NBKJeYjQTEVwbK:I3DLaRmF7XXB6SapwAxtrPsECm

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe
    "C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe
      "C:\Users\Admin\AppData\Local\Temp\a83dd75d61102086fcddcbe2b48f644b.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2008
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of WriteProcessMemory
        PID:2716
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Windows\syswow64\svchost.exe
      "C:\Windows\syswow64\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\SysWOW64\ctfmon.exe
        ctfmon.exe
        3⤵
        • Suspicious use of FindShellTrayWindow
        PID:2784

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1260-22-0x0000000002970000-0x0000000002979000-memory.dmp

          Filesize

          36KB

        • memory/2008-1-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-18-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-15-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-20-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-12-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2008-8-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-6-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-3-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-21-0x0000000077E80000-0x0000000077E81000-memory.dmp

          Filesize

          4KB

        • memory/2008-16-0x0000000000400000-0x0000000000415000-memory.dmp

          Filesize

          84KB

        • memory/2008-17-0x0000000077E80000-0x0000000077E81000-memory.dmp

          Filesize

          4KB

        • memory/2060-0-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2060-5-0x0000000000340000-0x000000000035D000-memory.dmp

          Filesize

          116KB

        • memory/2060-13-0x0000000000400000-0x000000000041D000-memory.dmp

          Filesize

          116KB

        • memory/2716-24-0x00000000FFCE0000-0x00000000FFFA0000-memory.dmp

          Filesize

          2.8MB

        • memory/2716-26-0x00000000000B0000-0x00000000000C0000-memory.dmp

          Filesize

          64KB

        • memory/2928-29-0x0000000000080000-0x0000000000089000-memory.dmp

          Filesize

          36KB

        • memory/2928-32-0x0000000000080000-0x0000000000089000-memory.dmp

          Filesize

          36KB

        • memory/2928-35-0x0000000000080000-0x0000000000089000-memory.dmp

          Filesize

          36KB

        • memory/2928-38-0x0000000000080000-0x0000000000089000-memory.dmp

          Filesize

          36KB

        • memory/2928-52-0x0000000000080000-0x0000000000089000-memory.dmp

          Filesize

          36KB