Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/03/2024, 12:28
General
-
Target
bb42e3a501c4d0f9ed17978e3370c80a.exe
-
Size
52KB
-
MD5
bb42e3a501c4d0f9ed17978e3370c80a
-
SHA1
72e0e325e523b2446a38a6bdb937c5c1c94ef8d6
-
SHA256
ca64911882c27481ff1b8401adc825248f0984d0f2078af63829bfb031188488
-
SHA512
2a34ee9ea44b4ba04ce5c79d684297bc1b547975bfbd91435030d22f0cba16d3d71efd5b4c00af744572939d119be74e0fb7601d08e089ede1eca36067d42d22
-
SSDEEP
768:Jk2uN/G7eS8c52ll5BIyI3DngWPo5lNMfcszkXcyWCkqHAQIxgusPE0LpF:J0G7d2ll5BhI3Dn/Po5UlqH2mpv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 2 TTPs 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb42e3a501c4d0f9ed17978e3370c80a.exe"C:\Users\Admin\AppData\Local\Temp\bb42e3a501c4d0f9ed17978e3370c80a.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1