Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/02/2024, 03:06
General
-
Target
96155a38b593acdb933a649fbf07be1b.exe
-
Size
392KB
-
MD5
96155a38b593acdb933a649fbf07be1b
-
SHA1
af0605118462a16f89ad861e615c23a786882876
-
SHA256
75bd52d6b6849bfc8d064f900aab47229e34773c3fd6c7a824ab4c9d4392197e
-
SHA512
b32374d45c16cf6ca1304924f2a23fda9f1f4296907fbeed2a0819d5a6f515c090ac570c4c0ff9d6771bb3d846a2a155e2c4b9432b8c8eac76f1aa49dc9db1f9
-
SSDEEP
6144:htiBUkqkFwzgVq767LkLbv1P/AxrvNCBeq0fG5bfAYSR6VbysZk1dWyRr3dm7HO2:qgCJibvNYJbxYYgbRke6DBu
Malware Config
Signatures
-
Windows security bypass 2 TTPs 10 IoCs
-
Disables taskbar notifications via registry modification
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Windows security modification 2 TTPs 14 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\96155a38b593acdb933a649fbf07be1b.exe"C:\Users\Admin\AppData\Local\Temp\96155a38b593acdb933a649fbf07be1b.exe"1⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\043A6AEB00014973000C5A72B4EB2331\043A6AEB00014973000C5A72B4EB2331.exe"C:\ProgramData\043A6AEB00014973000C5A72B4EB2331\043A6AEB00014973000C5A72B4EB2331.exe" "C:\Users\Admin\AppData\Local\Temp\96155a38b593acdb933a649fbf07be1b.exe"2⤵
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD596155a38b593acdb933a649fbf07be1b
SHA1af0605118462a16f89ad861e615c23a786882876
SHA25675bd52d6b6849bfc8d064f900aab47229e34773c3fd6c7a824ab4c9d4392197e
SHA512b32374d45c16cf6ca1304924f2a23fda9f1f4296907fbeed2a0819d5a6f515c090ac570c4c0ff9d6771bb3d846a2a155e2c4b9432b8c8eac76f1aa49dc9db1f9
-
Filesize
355KB
MD5ed03c306325bf97bc1e8c6251cc226fe
SHA11326a99151b42643d2cfb0ffd0abd2a0b70af933
SHA25654008bd937617caf50e024db7d2c72adaca7e1b0009c90ec45891d3fb57964c4
SHA512c2e9af18522dfafd9363b51723a89e0fbd393ba7eba8116863ce7f71eb714b04b371a91a3eaa4aec6c939a6c5e079593fbe99f0cb296ac37a47ea9d03de478ed
-
Filesize
321KB
MD532e86321759e96351900458a5bb8779b
SHA157a6ea6ce6abf1618215482843919f27218a13cb
SHA256efeddd09d933743407752a1dcb3679c99d3f09a2e28e48b008071e2b100b1603
SHA5128a2966d276a395ba5ff52f38fe6ef0def5ef492b2e90e1268359fa5fe31a9c6e2e77a8388817d7a31069ba7a75d57a09f01917939feb2298a99d10c35b25d17d
-
Filesize
361KB
MD5c6c6b104d7114a0dd598bb68487e3711
SHA15b8650e9fa851e76b715861ed7ea78d2acf672d4
SHA256592c1d9285e7b91567cbe70cb0b1d721661d437d4fe30b228d603eae957dc67d
SHA51250878c35553d4f87465f27ba07d3c5f9c350b984478f77cef0fa47c14f1df602f657958b93f519c2eba9666073498badba67f98340ce3dc7706dabcfa3e7cddc
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB