Analysis
-
max time kernel
122s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
03/02/2024, 03:47
General
-
Target
8b5085bcd2fc913a8ba1ec86f193cd0b.exe
-
Size
70KB
-
MD5
8b5085bcd2fc913a8ba1ec86f193cd0b
-
SHA1
c2f6a485ababc93ecd6e3fa91e8c0fcfda63317d
-
SHA256
eb713d072fb0667c26d01ec4e5ace6bb5338d4db964b3e76522a2ea315cd9d66
-
SHA512
e836fd116049455c18ba891724c409a7fcf12b5ee5a9ccd94b65bbcfd84a41a9cfb4dd2d3c4c8f0f99e83a0b34c208dda3a22f7413cb83ab7e75fa96f9c82f61
-
SSDEEP
1536:+Voxa8Vvn19gwVSULC7pWpp7g4qGlR35fzSxx3WBIpqHola:+VuV/12WLLC1Wp+4q45fzSfcWqHoM
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\8b5085bcd2fc913a8ba1ec86f193cd0b.exe"C:\Users\Admin\AppData\Local\Temp\8b5085bcd2fc913a8ba1ec86f193cd0b.exe"2⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
MD54a8f5f9c5116fecae04ec398bd3115ef
SHA1ea01ee51fc72e21a8f19a90cc6dfc8a5875ef513
SHA2564e894da46d9719b6b3651378fd2cdd90c1738fe56da954e85b0d653266720007
SHA512c4f9d28b068408693b480003e458a637d3d852f5d7c22de72335ddef95a8bbef5b733206821254ea78b59dee660c6cbec3ae679e01bb2d6e8a6a4c19e8cabe7e
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB