Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23/02/2024, 14:54
General
-
Target
7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe
-
Size
482KB
-
MD5
25d72d34f52ba14ada5c72c9eff02463
-
SHA1
098c93ddab6367c98aa99768e2da6867dd09efa1
-
SHA256
8744e6236ee0b20a5f3c67b2de79a0e7089ef99ab1328a3040e229233bc4899b
-
SHA512
f272f873e9eb8452393ad1d5944aed253711bbb4f0a7f3b0ce138c2129942293330df93056a2d3753e6d6ddcecc50df2f910e45d37baa6c456d018ee5c66c6f5
-
SSDEEP
12288:ksZKAFyMOm0WWVjQOr7omnx552mZeCUfFv:kq0nm0hS5mnb52m9Qv
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 14 IoCs
-
Suspicious use of FindShellTrayWindow 27 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe"C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exeC:\Users\Admin\AppData\Local\Temp\7092574d38d36e89946f9dfc7725a621f9740ecc6b48aab0786587d6ee3d9bf5.bin.exe2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
482KB
MD52b3fc0311cae9ebf8870e3c894648b32
SHA12740b72a6c6bf22db57274ea9c02e773a60f7d7f
SHA2565af28ebb15a196dead564ecf16138fd5b5d6085fe88be8a0b0fe050ba5ac2dfa
SHA51232b7b629fcee947f4653f5c5b52d835afc7c55e0c19f69f6f01120af1f3929a6d9f217c34bcb19b1f2d5768a2a801471773851fb9af2de349705cf25606d049c
-
Filesize
360KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
360KB
-
Filesize
360KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
456KB
-
Filesize
4KB
-
Filesize
4KB