Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
17/01/2024, 18:50
General
-
Target
63558a4a85ea28ea806dbbbb82da4023.exe
-
Size
35KB
-
MD5
63558a4a85ea28ea806dbbbb82da4023
-
SHA1
54dc99007e9fc85e4da2e85e57ba1a16cd46af56
-
SHA256
b02d3302ea850cde783434fe8a7ff2dc74da670e55c683447687494f12aa0186
-
SHA512
c2251a57aef3545191aa687e8d03db0d27105821f3420f857a3078ba0652e382df1240d208295b386413f509ae94282bf9a7249ebcd2f2a8628eff0bf1cc7720
-
SSDEEP
768:7A9BonzA0s6wTbAeyq22LB4GOk7g4ltBiX8hNyPVoqlwCIxXqo:7ArfFQ2Lio0yBiXYN0oq4xXqo
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\63558a4a85ea28ea806dbbbb82da4023.exe"C:\Users\Admin\AppData\Local\Temp\63558a4a85ea28ea806dbbbb82da4023.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
-
Filesize
140KB