Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
06-03-2024 02:34
General
-
Target
c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe
-
Size
4.1MB
-
MD5
46ce83fd31d1b64c184e4307862dbc11
-
SHA1
b5937bc379c27a4c48d2c34d542afbd2da71bf59
-
SHA256
c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767
-
SHA512
70db9fbd15f87943af49b3173118ee186bdcd24d69db378cf4c2c127eb2074a86180f3a122846fbf25a06e2d5733040b2e971332dabc4548105d1d4f5780c1df
-
SSDEEP
98304:DjezfWnQE225WlxBP1FTHPwY7hSzmL26WPm4I4pDyD:3e8QEOtFozl6WPm4lFo
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 37 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 37 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Modifies Internet Explorer settings 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 9 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe"C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe"C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe" -gpipe \\.\pipe\PCommand97twirnowgndnxdsa -gui2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe"C:\Users\Admin\AppData\Local\Temp\c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767.exe" -cpipe \\.\pipe\PCommand96gfedbjtphvyklwj -child2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\ProgramData\Getscreen.me\qvtpdlvmdwvgmlbbfhxeasnhgivphkv-elevate.exe"C:\ProgramData\Getscreen.me\qvtpdlvmdwvgmlbbfhxeasnhgivphkv-elevate.exe" -elevate \\.\pipe\elevateGS512qvtpdlvmdwvgmlbbfhxeasnhgivphkv1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680B
MD5e1bf1570c899bf5e45f5fd47b6b52bc7
SHA16af1c676449bfb2c98288840826ac8555af91f8b
SHA256167dac759ce6870a0ba6435dd2901a56aae37ed881bad13af3248b45cc0e4bc8
SHA512f5521ec5cb3bbd50c455719970911d279824b8ed26bc8527d92111d8fe937ab93b42ed4332c1a46ecccb0dac9222647e20532553384a164e0d51a432dc62070f
-
Filesize
2KB
MD5c483f2169e8a262c61eb3160f7019172
SHA1f59a65767c57079bfb69c809d0ae7639fae437b4
SHA25697328d950caf15f1a44afdf8028e2a111ca55e376486365a414e841461f275b4
SHA5128e615ad9698998e515f220adbf647114cb1dcd1b303fd5bc63953ba5aae7c4ba4d81357fe9adc910870e1536a9947b77557f59f1b56fc7f293f88383258c4d9a
-
Filesize
500B
MD5c4cdeb57d0b6269f5c0670e950dc9f85
SHA1c0e82cb79b4522131b8ae5d8c04050c5625022d7
SHA256b674e80944f8d6b0b6a376259d2d9828eb1d99d39a5ef42569efa33b12a198c6
SHA512b8fa8c25037c41e1536bf5faec510a3325c2bcbb3fb3ef1b9ae507a7eaeed34df19981dc49bdb36463b289e2e304cfe6158d9c5eee84a8195e30d67826464001
-
Filesize
4.1MB
MD546ce83fd31d1b64c184e4307862dbc11
SHA1b5937bc379c27a4c48d2c34d542afbd2da71bf59
SHA256c6931330ac5b1674f9b2c3691f2c061b51066839622a49a97f4608a3959e1767
SHA51270db9fbd15f87943af49b3173118ee186bdcd24d69db378cf4c2c127eb2074a86180f3a122846fbf25a06e2d5733040b2e971332dabc4548105d1d4f5780c1df
-
Filesize
4KB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB
-
Filesize
24.6MB