Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
11/01/2024, 04:33
General
-
Target
528b4c4307866d3cc00993d2b9f940b9.exe
-
Size
36KB
-
MD5
528b4c4307866d3cc00993d2b9f940b9
-
SHA1
9ebbc4019e727afd35dc6da2cd5e7c90e847b570
-
SHA256
005ceb9ec9ea4d0787ed4af5e00fe4fe8fa37181447842271d42a7298f877346
-
SHA512
a288249c60a6cb1deeeae31658cdaf7f99eee73160f6b1d45c4c66a4ac2ea43b338c8de62d23f75d56eb4ffd445064f213de4338f67f92e3c7baa37261e2c595
-
SSDEEP
768:qBaskb/svY73m3+68gcBYaeQVQI3DV7kYzVNNMfcszkXcyWVZy:qBm/svY7346BYaeQGI3DV4YzVsx
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\528b4c4307866d3cc00993d2b9f940b9.exe"C:\Users\Admin\AppData\Local\Temp\528b4c4307866d3cc00993d2b9f940b9.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1