Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
18/01/2024, 20:08
General
-
Target
65ec86bfad4857abadcb07d8f0f66c89.exe
-
Size
375KB
-
MD5
65ec86bfad4857abadcb07d8f0f66c89
-
SHA1
3dd2f4d581d62258f52e2cbd1b3e34bc00b3fb2c
-
SHA256
8b265fcdc3a9f1010d64920a4e7b4d7de6c8c85b7c3771667daf71a523791fd9
-
SHA512
42078a644ee3c50eacc0741647fcdd3314e47708055d6b19e7d095589d3d1b45a1f67970b011a7ec90f0a274e3ccba915aefc6a6e897cbbab7ca3ce953e93939
-
SSDEEP
6144:I/ojvR8qZnf+fkE7tEP9rU4SlYk0KfG9a4s9nDcwJUAYSxC4k4eqXm5KdVrOqeLp:IAd8qZnWfkE7+PJUTdfGJMxJUAzm4/Xk
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\65ec86bfad4857abadcb07d8f0f66c89.exe"C:\Users\Admin\AppData\Local\Temp\65ec86bfad4857abadcb07d8f0f66c89.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\jI01804IgEhK01804\jI01804IgEhK01804.exe"C:\ProgramData\jI01804IgEhK01804\jI01804IgEhK01804.exe" "C:\Users\Admin\AppData\Local\Temp\65ec86bfad4857abadcb07d8f0f66c89.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
375KB
MD57784600393c37a5572f11d0dc17a0924
SHA17fe4c2c761bceae2b62a6915ea4d1a5b4b54573a
SHA256791284d3b64da2b842d6316be16d657d54deedfbe6add6bd41dca30d3f0f20dc
SHA512b3f12605adbe3d71c613f73c0f2fe308a26c636fda3e59e7166c1ae2e912d29093d681cfb9db8627bd90199cf1bb7f766da6cc345811bf0a7021a7dd837bf57a
-
Filesize
800KB
-
Filesize
332KB
-
Filesize
660KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB