Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27/01/2024, 15:54
General
-
Target
7aa859fde6974acad492436c5ad8c117.exe
-
Size
82KB
-
MD5
7aa859fde6974acad492436c5ad8c117
-
SHA1
5ba50311a7ae31b860e1c927acc96674491d6f2f
-
SHA256
edef61fc4883d6fa82f7d611fb087847f38a5ce5da6b560027e092a2a3e464d6
-
SHA512
68fdcbfaba0bec6d6fdb8d09546d45806214ff9e9bc5b12120234faab433f0a894c3c09331aefedb6fcf8f9c9fe6a42af2b66a6004a7c260bfffaf77c15486d9
-
SSDEEP
1536:8xnn664v//Yw+3rK/X3iPhP1PZIvO/l1rXhL78aavo7mdH04mWgPTX4r:Yn6v/Aw+7K/XSPTavM1L79Bi04N4TX4r
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aa859fde6974acad492436c5ad8c117.exe"C:\Users\Admin\AppData\Local\Temp\7aa859fde6974acad492436c5ad8c117.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7aa859fde6974acad492436c5ad8c117.exeC:\Users\Admin\AppData\Local\Temp\7aa859fde6974acad492436c5ad8c117.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5e34bfc71248bb8094c99baa1b7a05f54
SHA116d817d5b3eb928420df1b0713b6e6ae1a97dfc6
SHA2566dadff10faca18baea182bcefc731bfe49869bea5742acbd7e92ac9db945e35a
SHA512f74c64c2f63f567bb5ad1349490527ec3135cd47536ef226e8943695eb710ae6525bf3c0da40b8acbafe839eaed5208855e2ca6d7f3b27c14aff211725c96a25
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
108KB
-
Filesize
188KB
-
Filesize
56KB
-
Filesize
108KB