Analysis
-
max time kernel
136s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
08-01-2024 07:37
General
-
Target
4ad4f1510241a99d3df6e8c9a6ce1e77.exe
-
Size
386KB
-
MD5
4ad4f1510241a99d3df6e8c9a6ce1e77
-
SHA1
31121ac5052639c57122a471e3304763d850ad25
-
SHA256
630cba04d316ca87e594ae5f6a59af50ddc8c3393bb9b9a6ea4a7e889045230f
-
SHA512
d787c571daf62a88f648d5c709fdd0471b63ee222fd20e8ebf0018458f981dfdf008e5c34795a4cf3e5869860ca81f8de2d72661273dfadb334f9cc91dfb019c
-
SSDEEP
6144:iCHDKhB0WCqB7l+04YmQ71poL5Cgg2GaSppsBUdZeppRSA6G7F3tNyu:tHmhW4BxXmQ71pkCg2aSoaISAxPL
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 5 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ad4f1510241a99d3df6e8c9a6ce1e77.exe"C:\Users\Admin\AppData\Local\Temp\4ad4f1510241a99d3df6e8c9a6ce1e77.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bK28303JiOaF28303\bK28303JiOaF28303.exe"C:\ProgramData\bK28303JiOaF28303\bK28303JiOaF28303.exe" "C:\Users\Admin\AppData\Local\Temp\4ad4f1510241a99d3df6e8c9a6ce1e77.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\bK28303JiOaF28303\bK28303JiOaF28303Filesize
208B
MD5c46deeadcffb8f2ae2a9f2b9829dec25
SHA10c9dd0d2a571070b653d20b4a57247e0878593a1
SHA256a066fa0f01b3530823653254baf8d51dd0b6d95b16a7ad7c07ba238f8e4503d7
SHA51240583c2267aea41efc2c5bbbbcb6b8f7b4c5ae3785a03358b470fe9abd365c6ebc54b6bd159ce04e4b7cd2d376833f9df7e39222e53069a8509b94ef1b4b1c75
-
\ProgramData\bK28303JiOaF28303\bK28303JiOaF28303.exeFilesize
386KB
MD594495ee10ccd8e879696f1c9119e65a4
SHA1bba6331fa9a3fcd51d5e9ca3a74e053774195fc4
SHA256975d914f1a2de4f27a6d67adad6c8d6329f96f69d8931ee126824a299cea4510
SHA512f85969b29210435e1b2f14acfaffa07e6b588f030534bec27a3adaebced44bea9701d52f6eac73121c05fafa58611b4ab74946c8ba831fd451ad7b0d11a3f511
-
memory/1184-86-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1184-87-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1184-165-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1184-201-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1988-0-0x0000000000250000-0x0000000000253000-memory.dmpFilesize
12KB
-
memory/1988-1-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1988-2-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1988-162-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/1988-196-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB