Analysis
-
max time kernel
156s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-03-2024 17:45
General
-
Target
b549fa455cc8b66ac27a271fe76c6cc9.exe
-
Size
396KB
-
MD5
b549fa455cc8b66ac27a271fe76c6cc9
-
SHA1
ea2bc94ac1ef48881686f79dcfc497da413de324
-
SHA256
3e5b1286667ea037f6baa0ebdbfe91fbe78262927b5149bbe2d2de201ed0533c
-
SHA512
4804649d8b06c7e4fb40129ffc1bd4868c03d0285b0a24ce86f818e8608fbd049909f56940ad0a44bd2bd68f1251dd8698b1fd9822ca8a469cb6ddb222c1fa2b
-
SSDEEP
6144:4YxZYe1tF9t3iY9tRQDnTB48KyNo4LYpXPjqijTHTM6Qb589up5+VVOsRiBmzo:PxZh1H9RfpMnTRKyUXbnIr/+2ks
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b549fa455cc8b66ac27a271fe76c6cc9.exe"C:\Users\Admin\AppData\Local\Temp\b549fa455cc8b66ac27a271fe76c6cc9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pD01804IhHoN01804\pD01804IhHoN01804.exe"C:\ProgramData\pD01804IhHoN01804\pD01804IhHoN01804.exe" "C:\Users\Admin\AppData\Local\Temp\b549fa455cc8b66ac27a271fe76c6cc9.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5888fa01a62bc1ae573248eea1886d691
SHA1361de50d7b2e816b591c602f1b54ac76ab1c0942
SHA2565022f587cea46d7d214c4ebc90e0278ccf0ad95d9cc571cd63eaf15cc5d67da3
SHA51286b445467008ab895040c4d2886e7560929efcf5a1b1ac5b88c886bbaa631b64373288b357e26d435e375f287f746badae476720f8b5a31d4913aa3d8ab4e34b
-
Filesize
396KB
MD5bca01fa2bd85b075d0bb8c96ab4a5c4a
SHA18adb36a6c6ff718d994de97b14405dadf4dc7a43
SHA256db3dc1d4246bb42247330bd82b28e117cb34250ec99c33acfb9bc426ce43538d
SHA512abfd32f9f08136b5e5b725e7cf4d0c4e9b193c80038ee212c0eb00e1279d49177c25205dbd02213dfbabe99700943bca9d449f9c017f88aa8be1e568381df25e
-
Filesize
8KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
960KB