Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/01/2024, 05:08
General
-
Target
7676721620b07f6f5771109103e30b75.exe
-
Size
436KB
-
MD5
7676721620b07f6f5771109103e30b75
-
SHA1
ee20ab95de265f092a6f0c8c97b1b653a2583796
-
SHA256
acf797b15ce985351a3f652739faf7515478f2eee824e02c8b78fedc34a756dc
-
SHA512
c9d4731395dccfc7535bdec78ffa7e1fc4b74a393a3ee4403981a2df7d08c478e742e1ddb464aee7cb6603b42801b6671a1e7656c9f516c7c52575fbd7ccadb0
-
SSDEEP
6144:npUqMbsFS9IpMgsuk15EOCtrabCntJtetmerRZWp1TS5QybF/Q2I:7nFyIeuk7ETtWentgme6pG5/
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Internet Explorer settings 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7676721620b07f6f5771109103e30b75.exe"C:\Users\Admin\AppData\Local\Temp\7676721620b07f6f5771109103e30b75.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\ProgramData\farErWOHlXkPpQP.exe"C:\ProgramData\farErWOHlXkPpQP.exe"2⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD543ab58132b04321480cbeb065919f324
SHA15be0d5c2a4594f32493ba67b27f0245492f75b28
SHA2569965cb7150cc231cc1319cdc5858fc6019be84ef1df8734b55042336e4bab2fc
SHA512d1725ffa02348cd58695d3a9be87c516875fc9a2f9263969241ed0d6db80a06933f8754217563303be608d791a56f0cf8bdd1ace4f1103ef3a783e5f5501b944
-
Filesize
149KB
MD5b034815483fa95367ae9c88c574e7d1d
SHA1d2342c80559a79b7c36f4fc2042ff95f92f79eb5
SHA256d2c318e437bb7da3d1081f53079c17dce783eadd96960b94a65e14a5d9f51507
SHA51240815047d72ccaf1037daadb825090bf348dc82a1ab22ad17ebeda502e22d9107ebdea92be2d3af705e0b331c3e4017caaa9eacc5cf7b65bf4acaef2f6c060e4
-
Filesize
155KB
MD509110ccf191d12bbcc3d206acc5a5dc6
SHA1e6488f2b01ba8993779335a1a35c496818691e8c
SHA2569773f4696dc7855f3315b6fb7cb983ac669b004f2071b43a5254369c17a20a44
SHA5129b292fd9f4fd0fca211872fa332ed0b0798569309b65ec1f2fe062b973718b7b2843263c3fe6867b7203d7643620c733a7e50d1fdb50f91f5efd385fa7716062
-
Filesize
97KB
MD5e841047bdbb89fff917c8e3adf46e65e
SHA181792d05e00762343538a3f39a5c9ba4b2488c04
SHA2565625c4a7b3ca2dfb9f931e798f5356244882f9ca494968eabf605b37f7912d90
SHA512f310761191183e628b7d73c9acbc628885e83259b44d2260a4e51ecc7cbaa7f53f2d39a8c84dcc10a7b58d1e0d1d1ec28beb3887e821d97788066f8634694c83
-
Filesize
504KB
-
Filesize
360KB
-
Filesize
504KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
360KB