Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12/01/2024, 15:34
General
-
Target
ed30a11ac95e40d94d7add3a81458fe3cc794283f18fe2941a0eca4b9e66a2e2.exe
-
Size
536KB
-
MD5
19a9ce9d71f72aea73ef92352289990a
-
SHA1
63120246d073949df8e0e5b4846dbd37801b126a
-
SHA256
ed30a11ac95e40d94d7add3a81458fe3cc794283f18fe2941a0eca4b9e66a2e2
-
SHA512
ac09a83e1a067be2c6925d02cf88d57edfb41dcbe385c952de17176685d4390ed46ad5f6f4ce2e94007e168fa66f6c504dfdd98e307074f5d0eb99aa9630e31f
-
SSDEEP
12288:Thf0Bs9bDDq9hu53Ltp/p+gPhhwPOaoTJRkmOkx2LIa:TdQyDL9xp/BGA1RkmOkx2LF
Malware Config
Signatures
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\ed30a11ac95e40d94d7add3a81458fe3cc794283f18fe2941a0eca4b9e66a2e2.exe"C:\Users\Admin\AppData\Local\Temp\ed30a11ac95e40d94d7add3a81458fe3cc794283f18fe2941a0eca4b9e66a2e2.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59271aea03fc2c3f32e23a8fafdc27dd0
SHA1ba79c68ae4e7e7e9c81c141f03267f1bf165a45d
SHA2568c7b053a43c5cf3f50693f68406878e5620faaf45450a8b00fdf70b6978cd706
SHA512e1c013adac2bf74dac6d37eb2ddd9fbcaa6e176f912fa35c5b08d5858d295305777ec536180cbca03b8260d5a428fc7d00d0069db097a4ad4fff02b427d61ddc
-
Filesize
939B
MD5eb476edd1aa38b5085cb8474812f7e25
SHA1fa8cbb19cbba2dca302bf86ffa9b904aea1a52cf
SHA256e60f60372165bb970bb69a83524a107c2a2dcc2c45f65cc1aff3a436dabf9590
SHA51210172aa9b52ab2eb421ab3d5e21dca0f15b4341793af4b549185d545a08c6cfdd868ac56ee63af1259dba6443c73ace431f6c329eaf0c7e3dbfe0dd2dfd1071a
-
Filesize
502B
MD5a39b425a07fb2c6bd6bd50e29469fe7c
SHA15774d6d3a7e5827822ee6d5c86b39fa54e633bd0
SHA256341c21ef0d5d2a913c239bee56ac031c277e7601e84a4816d9d6ca45327f0803
SHA512f7eb8ba912417d3ea561a54f4e253d5e328dfb0cfa928373df3aa7c332b14797d22efb0cf1f0188fb2035c3a1f99e9c3e09c4e1fbb02b2d9694c8da2abb64d82
-
Filesize
520B
MD56001ca4d70c1c4077d6dc066c80a24f7
SHA16e43e5b875c279c9d69bc3eabb81da861ccca434
SHA256ce25ef61bc497188417e3245334f87dd708c2a85fef4876225198c3703fef785
SHA512c4c54f98ee3aaefef3fe5ea89bebf637b2923d65fd2cbabaa4f31d7053b72631d35aef30887900d84e40d03375afa536f8d3c1f8f0ed85195dcd09fff6133dbf
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
12KB
-
Filesize
484KB
-
Filesize
12KB