Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-01-2024 17:18
General
-
Target
7d8e6d2749fb2f610abb2089cac32e7a.exe
-
Size
172KB
-
MD5
7d8e6d2749fb2f610abb2089cac32e7a
-
SHA1
b0ecb2695be0a6329756ec0caea4bd2df90f2f20
-
SHA256
7dff7528f412fc66a209d6d88bb9559b51e09f64c9b6944b7e98d6e0414f36c3
-
SHA512
e0fd59403e389c561cb91b9e6975fb88446f05d6978fd6b8ccae61d710310756542b65739bdc1c333c71d8200338b880f7d1f169a47e5fe0119aa6188d94b999
-
SSDEEP
3072:ku4PdaYs8HTk17MoZAuzZ6NqGy4lx6+m:ku4laYjkaoZAuzZ6wh4r6+m
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d8e6d2749fb2f610abb2089cac32e7a.exe"C:\Users\Admin\AppData\Local\Temp\7d8e6d2749fb2f610abb2089cac32e7a.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\msa.exeC:\Windows\msa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD515884a43d66679cd10697a5bb1054975
SHA1306df9f98b78fe221eab4e7f948c58fab66730bf
SHA2565a4d8c68790eadb8cfca203cebb10f11e34ffe8ff102643f597a07cca3093996
SHA512504ec9cbbc7f180e09a847b3ffbb0239a9f7ee0f7ff20ef99e24d19101d8475253db25b3b206f9091ae366d9d6c6290f2388f64a60bb271fde84b0596b4190cb
-
Filesize
172KB
MD57d8e6d2749fb2f610abb2089cac32e7a
SHA1b0ecb2695be0a6329756ec0caea4bd2df90f2f20
SHA2567dff7528f412fc66a209d6d88bb9559b51e09f64c9b6944b7e98d6e0414f36c3
SHA512e0fd59403e389c561cb91b9e6975fb88446f05d6978fd6b8ccae61d710310756542b65739bdc1c333c71d8200338b880f7d1f169a47e5fe0119aa6188d94b999
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
4KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
4KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB
-
Filesize
484KB