Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/01/2024, 02:05
General
-
Target
73732658650643a02049bd439e649d23.exe
-
Size
6.2MB
-
MD5
73732658650643a02049bd439e649d23
-
SHA1
0053e7fd273f2e4c12dac95eedffa0f79a36b052
-
SHA256
96ec2b2507de0bd5269ed6336214982170a1cace9e0ff1607b6aeb4fb5e8fe1b
-
SHA512
d84d7469dc854146b7833d2e87919286062b6e41fbad5d269fdef278b943be496bc07f805be02f8d08037c08b579c0ebd8bd04d285fd10060272c2212e90e277
-
SSDEEP
98304:XHqPmH+R2r4fFtmocc/v21KsSXLzOh69CBkvZcUf1aphMoRdKuIXBbvCwc:3qOeRrQlc/AV6uh69CBhQ1ghVRd8lCN
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies registry class 25 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 28 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\73732658650643a02049bd439e649d23.exe"C:\Users\Admin\AppData\Local\Temp\73732658650643a02049bd439e649d23.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD59eda6ac05d976773bec1a5ac2fc19c3b
SHA15885ea8e22e1d85b30e5e899c2f803c0212edccc
SHA25647cc32f966ed28e1bd719faa6ce6d2919c4d447ef784b866155796ebb410ae0a
SHA51221401d8c5336832d3603e596564065e20f178ec8cf5a983b232cdea97f1b5b55a6d3cfe141262e3680aa2caae8bcf9ec41d1db07e3d3edc243a7c308461975a9
-
Filesize
192KB
MD5df9ffe8b2b937c3316bbead7821bee5d
SHA14d6cb8554e3f9f243a775e9f9b5e107e31ebe571
SHA2564e760b339619cad772323203f2c9b4adc0c1e9b335f657afa0cb4087a036c42b
SHA5121e1cd1cbf337557333e341459f80a28cbd68e8452fca3ea844726afd19463404bb60760b1b1e8dfb881bfa8bfed6fdc77b1c31a55b8f9f63dfb9d7ad9de704fd
-
Filesize
132KB
MD53a9fff286cf967cfd251324c83bf4921
SHA1e0c90a51520ef36803469f3de79039db01cf49b9
SHA256bed9643898f91e7bcc4d551ceff435c02d71867cc5a950b0de53489e26cb2155
SHA512e772539f8f830d89797bd187dc07f1a66aea5aebcb7e8e2c569c8d53bcd19bb7deaf95c059c49c4d71dde8fdea07f0108e954b4cd966635881dc3e47bc62f4f0
-
Filesize
407KB
MD5f8aa1f66f236ef14c1fcfd65e8558686
SHA1e2f8958e6105013cb950b6223696c3aa3cb26092
SHA2568630003c16ad1770d12cb4b8e72b14953923b387991eff97426ff87a4bbca73b
SHA512ad40fe0e9925a52c2e8068d756a32551bdf4dea2f3485098b0548b8eaf128fd3c6f2237a5577ca51b0138df3c56975b033177f3d3b30c770364225e0cc6dc90f
-
Filesize
248KB
MD55379c9da4eecad6bd87e16fa9bf77793
SHA14952f040868210db520c15e2c948af48000da6b3
SHA256f0466700070303202910c7e7b740d3a96750b0fa8a5b5b035d789d2815d49029
SHA512a30f6a783377b932bd7c35194c883788ccde2f6040ae261d34aa22d93212a4f8184e9cf39208ddd52db23fb212a89757c1862df02bfc8ee90d61cca517485cde
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
200KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.3MB
-
Filesize
4KB
-
Filesize
260KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
140KB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
1024KB
-
Filesize
6.3MB