Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
01-02-2024 03:26
General
-
Target
85cc500e9d627adf6c993b35c10e32de.exe
-
Size
414KB
-
MD5
85cc500e9d627adf6c993b35c10e32de
-
SHA1
9f22a7e0577d657e418d93e9c2f501ffd94a50e6
-
SHA256
d6be4a9ced2bb27e8d077642c3ca0473d1d63123935719e293a226bffec8fcd4
-
SHA512
ecda6ab10dfcc208030b01078768a6282e1df6b14963b86ffec824b81a16eccc2a1144353c21ba60436ac4967776b1418be51314908b514f8efd36b2ac8b0624
-
SSDEEP
12288:xEU3npqLuOCtLpq7vnGjp2Vofyr3t/Fwh0uZatfGRxSI:xEU3pqLXEUQ2VofyxFwh0N
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe"C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\dH07501DcJiA07501\dH07501DcJiA07501.exe"C:\ProgramData\dH07501DcJiA07501\dH07501DcJiA07501.exe" "C:\Users\Admin\AppData\Local\Temp\85cc500e9d627adf6c993b35c10e32de.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208B
MD56a7a7c228024185c43f513dd4870313f
SHA1a8ade6f526c9aa75aa355260a182f85cbafd9eee
SHA25616340e8cf4d466d378192d689168b525d43bbd36409ed8297cab386fb6b74926
SHA512a9929b0aed8843090da47f6a086ef351dc10f0664d639c7fd530966a00a83be9ae88de4072a12e73af2a1a2c6d9389462bcb05224ac5a179af03b5b23a00fdcb
-
Filesize
414KB
MD5d8300fa2cd316081f70df2b9fd1b647e
SHA1346ff656e0e3b6cce5f0295e39950ace7e09ea80
SHA256db4f714b77fdfedf3e985d5495f4122dd289496cf39f82b87237f3e47bc7f81c
SHA512d72481d85d44e3b58c73dc7abc4753d28d3d87109cfaa65c5420f610a0fe7ac3942eb4dabe4bf14632d18c30fd8df5112b330046347759ba28d77741f9d83fd1
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
12KB
-
Filesize
840KB
-
Filesize
840KB
-
Filesize
840KB