Analysis
-
max time kernel
148s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/03/2024, 13:38
General
-
Target
b787f06059820f3d96e8a8aaabfd693e.exe
-
Size
321KB
-
MD5
b787f06059820f3d96e8a8aaabfd693e
-
SHA1
16ee749b3ffd10707937f659329f9fc5e6364b60
-
SHA256
ea9d3179ac9da0c37c890a3c43a0a84681b264418ccc647dd240823c7e6152fc
-
SHA512
12b98ab5bf9ca21ae78d495128a4f71109e89dcfcb31187416ae939d1f1b707de01c54721e24595d7c2bb69caade891d639cec05577a00c93ef0850c49082873
-
SSDEEP
6144:c4rjlbKLpBz/o6WhsjJ8wHljxFhfi9I9tMUle9IGnVrxPM/+EUn:c4XItWM/3Xhle53E
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 30 IoCs
-
Suspicious use of SendNotifyMessage 19 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b787f06059820f3d96e8a8aaabfd693e.exe"C:\Users\Admin\AppData\Local\Temp\b787f06059820f3d96e8a8aaabfd693e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\uvl.exe"C:\Users\Admin\AppData\Local\uvl.exe" -gav C:\Users\Admin\AppData\Local\Temp\b787f06059820f3d96e8a8aaabfd693e.exe2⤵
- Deletes itself
- Executes dropped EXE
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31B
MD55ab8e3fd3396e641054ae777bd0623ef
SHA19400df7b7a738f6c6c593a3006b217420ad4a713
SHA256fa38bed84411e8470a9903711d9c966d7c56affaa58b674ef9ddfac644f72e71
SHA51243464adfba2639c5789380b5ae1270239d9a88dc6904a0f22a8d7058ddd4351f184b569c0fb167e7d714104392e93410c16215fd959e0506d188f9489a480fb1
-
Filesize
321KB
MD5b787f06059820f3d96e8a8aaabfd693e
SHA116ee749b3ffd10707937f659329f9fc5e6364b60
SHA256ea9d3179ac9da0c37c890a3c43a0a84681b264418ccc647dd240823c7e6152fc
SHA51212b98ab5bf9ca21ae78d495128a4f71109e89dcfcb31187416ae939d1f1b707de01c54721e24595d7c2bb69caade891d639cec05577a00c93ef0850c49082873
-
Filesize
404KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB