Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 06:09
General
-
Target
797928f1509074c5affd6f6082a1a37a.exe
-
Size
1.2MB
-
MD5
797928f1509074c5affd6f6082a1a37a
-
SHA1
09538046e9bb4c77145d15279a32c5f3b056d5b6
-
SHA256
8764e63ba0ca5ccdb856dbd7b58035cb956feb71f1b0ce112b106692f3cfe804
-
SHA512
68ebeee5c93f96bb0237baa3becd4cfc10af0cb87d387cb7f4c850f58c8535e36b67286209e93d01f8e7979bead95e5103cfc583483cc0e21ab7b2d0976c69e9
-
SSDEEP
12288:opuXukhvhpjVwMQE3+5kWnokZAXR0qcjfwy0sQvXKvFZACED0G:oQXbvj2Mv3+5gkZA+qcbwLsQPMED
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\797928f1509074c5affd6f6082a1a37a.exe"C:\Users\Admin\AppData\Local\Temp\797928f1509074c5affd6f6082a1a37a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ba55c660e79ae4961efb630e3f9f5750
SHA1cda6e8d1bd9c7a1e37bee70e880cc64101c52524
SHA2569f6b154e65fce86b6aacfd600e8f63f087c68dee1f9f95e45d547b3d58e15cc7
SHA5127df75f5b9b4bb3618188ad7c42b607c59e731df3bddabd57c6f2393bd0087252f5b5985f2ea15fe151d9e93e0c319c8b181e34bae8c9a6a48fcc12551022bf9d
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
1.2MB
