Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 15:38
General
-
Target
3510cff25c95d1d4dfe31c99ffe29e539737d043e8e9d7b67c76fccd76fe8f5c.exe
-
Size
536KB
-
MD5
d3ffc753b9536ab8828565ebad5fe05e
-
SHA1
62650b478dd1d8061ac0f513fc362ff1106b8f0a
-
SHA256
3510cff25c95d1d4dfe31c99ffe29e539737d043e8e9d7b67c76fccd76fe8f5c
-
SHA512
32fa09788dab98aa1e9bda9ff494031498b096dbf58279430eea4b0b369e4b6ab8a6b512eadf9137e7341f69f01b25b0365532f98c3b2cdbbd07e3d8fbee09cc
-
SSDEEP
12288:6hf0Bs9bDDq9huzJgIJzgXaEw9Stu/aB9a/Okx2LIa:6dQyDLzJTveuK0/Okx2LF
Score
7/10
Malware Config
Signatures
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3510cff25c95d1d4dfe31c99ffe29e539737d043e8e9d7b67c76fccd76fe8f5c.exe"C:\Users\Admin\AppData\Local\Temp\3510cff25c95d1d4dfe31c99ffe29e539737d043e8e9d7b67c76fccd76fe8f5c.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB