Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29-01-2024 04:30
General
-
Target
7ee460c398ec82a2d9087d7792841ad7.exe
-
Size
443KB
-
MD5
7ee460c398ec82a2d9087d7792841ad7
-
SHA1
6c266cfdce5ef9c27c6851c5fba5c9a82fac6f8c
-
SHA256
0829208a9dbd5b8436957ca88974a555630d82c1571ecc1d67e2fbb74799d882
-
SHA512
5a50afb89bf9a6e2f4ec4a3184cd96ee72edb2b398afbe812aaca6bc561f9a4b5e7eecac90269c2b7ffa831cbadf657bb6dd3c57147905da59b031a27801a6f5
-
SSDEEP
6144:ZvY+xi6ylBDY2FhfGkZ86L+4Qm2sgqv2H2PxH7laxuMt9Kcg19ghgCLGtS0:I/BcAA6L+4Qm2LqSjtoJ4h/f0
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ee460c398ec82a2d9087d7792841ad7.exe"C:\Users\Admin\AppData\Local\Temp\7ee460c398ec82a2d9087d7792841ad7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lP01801ClEcH01801\lP01801ClEcH01801.exe"C:\ProgramData\lP01801ClEcH01801\lP01801ClEcH01801.exe" "C:\Users\Admin\AppData\Local\Temp\7ee460c398ec82a2d9087d7792841ad7.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
301KB
MD55fd6d7d25db4801ea245d78443375f47
SHA19f5940f9505a9d93f67b875d241a0374940acb14
SHA25632070822aa35088a8f581b24d5728581e26af61ba475c78223856fab782a747e
SHA512f98c7357e5ab531456888ac1914cd88875ba8d5afbe397de792a6371eaf77ae81ae9de96be82d5cc42c9b711c22c7166b9da63e283da631ff9dfd2ef857e183a
-
Filesize
242KB
MD56f0043c84107ab1b6d0d0a5f294facd2
SHA1aabd079e52cb300be2c57618a599a99b7c187372
SHA2564910fafb2d7dd4dec71e04bb42027315d8f1e6541a2f26ac93a4118db7c6d447
SHA51281c2cdc0b686ccd4b273b962ef91ce76c4fe9becc72242f52368f43f57131b3d96d28083c2bff02aa3a1eef676b1ccaf1710671ceaaf4c97f07d51bbb8a7b3db
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB