Analysis
-
max time kernel
121s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 00:24
Static task
static1
Behavioral task
behavioral1
Sample
c1fbf166120f8315e11978977ad1457c.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c1fbf166120f8315e11978977ad1457c.exe
Resource
win10v2004-20240226-en
General
-
Target
c1fbf166120f8315e11978977ad1457c.exe
-
Size
1.0MB
-
MD5
c1fbf166120f8315e11978977ad1457c
-
SHA1
59570e52429a29acc5bf8356bedc4c5a77b9839b
-
SHA256
04ea4fdc5c97309e7e6a7b92ca77db62926f4ee57f8baf0061c4619b3acca31b
-
SHA512
11e2749a2a2ddd736287dd37982bc12f9cec72136c65ed08607430688b026e1d3387652815fe858cac9e2ca61278742637bb2ebc2cdcd9c692acd6c93dabcb8f
-
SSDEEP
12288:hiRvLcJBxnYw2+9z3y0QqogzblEOGSEzUvzblE4wEQRUSEcfv44IdmIK0M4zkf:gSbxYTwziHqog+OP+ac34Lkf
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2912 c1fbf166120f8315e11978977ad1457c.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ws2help.dll c1fbf166120f8315e11978977ad1457c.exe File opened for modification C:\Windows\ws2help.dll c1fbf166120f8315e11978977ad1457c.exe File created C:\Windows\Wplugin.dll c1fbf166120f8315e11978977ad1457c.exe File opened for modification C:\Windows\Wplugin.dll c1fbf166120f8315e11978977ad1457c.exe File created C:\Windows\explorer.exe.local c1fbf166120f8315e11978977ad1457c.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2912 c1fbf166120f8315e11978977ad1457c.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
434B
MD5514996985dc67664849d36daa63934d0
SHA139b6fd1f5a743b8d31ad40a9e0b0431a5456e853
SHA256b0db35ffd540a686dfcc6e3bcb2ee3e3a83b5daf3d99876406fc9795a1f06b76
SHA512d80f411660a493f78d45cd488d49dd2ac310cf2091b7d0cba94e20739845a7e8d5142dfbf9b4e2a51b16b8fdd3d7c40b4cdac313296c26b183e64556b5954321
-
Filesize
108KB
MD58847a8302dacc1d6fca61f125c8fe8e0
SHA1f399142bbf03660bee1df555ebbf3acc8f658cf0
SHA2569c2726defa122089f8251fa104f76d66830f448774ab9bd634adbb6e492e3943
SHA5122b028bb4139c352b80db1509d1a3f479a8ef7e9b3b73ddbf62e2d83d4e59adf4a0bd6b9d68409bc0b6fafb7a5f56844fbfed6d00b824a6b370689801ce1c837f