Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-01-2024 18:13
General
-
Target
7aed7237efe983c564c171ae98df67f6.exe
-
Size
4.7MB
-
MD5
7aed7237efe983c564c171ae98df67f6
-
SHA1
45dd91341db5b20860147d47033e55eaa39e18e1
-
SHA256
3948123855df84dc645f59339450a2b796054e843b3ea842af48ef681ca2a465
-
SHA512
1926d818a03eea2b652185708c60261667022ba7315625376d101bcd4285b3c84a4bffa9bb4856e87950d0b907b39decf881db6877e8e413d963e7c419dcf1d9
-
SSDEEP
98304:tFePtfnNZY43q5aE0zPE5YbSE/9eLV9VIFFhfHatIO:fePtfnhq5iP6YWM92V9VIBjO
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aed7237efe983c564c171ae98df67f6.exe"C:\Users\Admin\AppData\Local\Temp\7aed7237efe983c564c171ae98df67f6.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system2⤵
- Creates scheduled task(s)
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
14.4MB
-
Filesize
4KB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB
-
Filesize
14.4MB