Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
23/01/2024, 21:29
General
-
Target
709b157e3a2c803fb8098dbafec59cca.exe
-
Size
31KB
-
MD5
709b157e3a2c803fb8098dbafec59cca
-
SHA1
5052255a66000bbd75a79c5bfc143ea965b1e698
-
SHA256
766c89c3686730c795edcf86057ebc36b770cac281e8c0bc7f8a8904e10be4f2
-
SHA512
4eb7559448097308a92a51debcbb46306d6094f2e0745d22e0cd526744e9926ce7b6c4a76ecf1e906dae21850635f763a4355255783ad78c72fbae2593513508
-
SSDEEP
768:pEfaObZGR4pueoQUV4gz2xOFBYsDtRnCWo0Kj9WyIEnPI:eFHoj5NBHai09WYnA
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\709b157e3a2c803fb8098dbafec59cca.exe"C:\Users\Admin\AppData\Local\Temp\709b157e3a2c803fb8098dbafec59cca.exe"1⤵
- Drops file in Drivers directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB