Resubmissions

02/03/2024, 22:38

240302-2kwptaae37 10

02/03/2024, 22:34

240302-2g86qsad96 10

Analysis

  • max time kernel
    120s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/03/2024, 22:34

General

  • Target

    6AdwCleaner.exe

  • Size

    168KB

  • MD5

    87e4959fefec297ebbf42de79b5c88f6

  • SHA1

    eba50d6b266b527025cd624003799bdda9a6bc86

  • SHA256

    4f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61

  • SHA512

    232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9

  • SSDEEP

    3072:sqp6y91BH91Be/MbNBQ3MypF06N25xOT5Ng2WV4:Oy/BH/Be00Mypk5sYp4

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6AdwCleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\6AdwCleaner.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2388

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          67KB

          MD5

          753df6889fd7410a2e9fe333da83a429

          SHA1

          3c425f16e8267186061dd48ac1c77c122962456e

          SHA256

          b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

          SHA512

          9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

        • C:\Users\Admin\AppData\Local\Temp\Tar9A24.tmp

          Filesize

          175KB

          MD5

          dd73cead4b93366cf3465c8cd32e2796

          SHA1

          74546226dfe9ceb8184651e920d1dbfb432b314e

          SHA256

          a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

          SHA512

          ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

        • memory/2388-0-0x0000000000C70000-0x0000000000C9E000-memory.dmp

          Filesize

          184KB

        • memory/2388-1-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

          Filesize

          9.9MB

        • memory/2388-2-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2388-3-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2388-4-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2388-5-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB

        • memory/2388-104-0x000007FEF5CA0000-0x000007FEF668C000-memory.dmp

          Filesize

          9.9MB

        • memory/2388-105-0x000000001B260000-0x000000001B2E0000-memory.dmp

          Filesize

          512KB