Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
29/01/2024, 04:41
General
-
Target
7eea016fa7082d60ff02f8a7ea355d4a.exe
-
Size
112KB
-
MD5
7eea016fa7082d60ff02f8a7ea355d4a
-
SHA1
f6ada8575a6b742e71d38f56ca5a771f5f35e0e7
-
SHA256
5a5d4f7e306c4630217dc3c9f7066bebaa1a1fe49a2a4eddafe72e75fd2f51a0
-
SHA512
6355b120fb1f70aae2b8efc4cb7c1514d665750cfecb5412ab2d2826c5f5e2684cf6152fd4a98e9dd4c9c3161a6a8baf2cdf71a279db29f471deae86a1c255aa
-
SSDEEP
3072:vcINEMu9CzG7jb+Wd0WCcjLQYB82b2+pq6v1jwsqKV:e/yGD+1bcjLQ+82KCvxwgV
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\7eea016fa7082d60ff02f8a7ea355d4a.exe"C:\Users\Admin\AppData\Local\Temp\7eea016fa7082d60ff02f8a7ea355d4a.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5d811471dfbcc6b9764e0f8c31d87c5b3
SHA16cc5e219193149b1260a2fc7af25f670d9f65aff
SHA25695974775c340267e20b692e87fe16b4360d5a6e6fb1094d375a6f0f430e1cc67
SHA512ae3990f0cadf3eb3e12ad694c2fe6c8c9352f55d5a0efd38b5fe2855b5dab81b7edbc29e2cbb195939c3e99aaf015e9331f73f5861c3c74eaccfd78094000aa7
-
Filesize
204KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
204KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
34KB
-
Filesize
76KB
-
Filesize
76KB