Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15-01-2024 18:55
Behavioral task
behavioral1
Sample
launcher.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
General
-
Target
launcher.exe
-
Size
13.4MB
-
MD5
31eed0ce913a22127c4327f9f5bc8084
-
SHA1
a82dd2e7e12c6442bb7992dcb94c7d16b7b0ff9a
-
SHA256
8a51aa6148cbfea47ea48828e64ddc0aaed0e0a8901376f450d2f9bb0f65d994
-
SHA512
3cd1f24324a93246ebc6fe4ebe8c9dfddd8d02fc846517010943c79f4d6dbbe06346d872c8eb265d2e2faca25fdb9c5746a9fb146b6b67fae1e18988203b8a82
-
SSDEEP
393216:VEkMD2nwW+eGQRIMTozGxu8C0ibfz6e57Q1bmXiWCUI:VUDawW+e5R5oztZ026e5uFVUI
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2552 launcher.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2584 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 2552 launcher.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
pid Process 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe 2584 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2552 1768 launcher.exe 28 PID 1768 wrote to memory of 2552 1768 launcher.exe 28 PID 1768 wrote to memory of 2552 1768 launcher.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\launcher.exe"C:\Users\Admin\AppData\Local\Temp\launcher.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:2552
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2584
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce