Analysis
-
max time kernel
140s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
13-03-2024 23:27
General
-
Target
SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe
-
Size
8.8MB
-
MD5
2335a750096cb245737b423794866a82
-
SHA1
29c676cf08535b01889a94bd181bc22f5d70459e
-
SHA256
7771efb67031aade42022b1ec6e9392b65d07e0180b82cb4e68f8709c6f4e03d
-
SHA512
6f43936fb086c9e2da62fe29f76f4206bf33e17fd8d853371808873dfe536f8c0978c4db3e79f55f533c11cbeaba65f9841b5175e8d3a1d32c98f6d0c20fc7f9
-
SSDEEP
196608:lDDbq7CsUmsR1V085lc6oLMmoOHImE459rmO3fXNDcfMvXi:lDDO7C31R1Vp36xzzjDaO3fW0vy
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IG9US.tmp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.tmp"C:\Users\Admin\AppData\Local\Temp\is-IG9US.tmp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.tmp" /SL5="$400F4,8637066,199680,C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Program.Unwanted.5011.4925.3230.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "ADU.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im "adunotifier.exe"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
152KB
MD582201cd8f401f00000b7575b24b3ad0b
SHA1fa3659e48990f2ab24f8e1bf9bb650f11641ffe0
SHA2569d64a934a4a12c61a33342151e674100e1ec0074d106612b1e81244234d93d67
SHA512a491696e66c64e751712c028f42cb4067339c7d2b231e7a889f006291c10bc74d6597f1a52270b979b9a63351d1e42cdf302f05cc6840c54551657bd0737ffc4
-
Filesize
1.2MB
MD5cd31650b1825f94d40916975931def27
SHA1797184e1856305b590ea138f6fa4139499c1f60b
SHA25604449628d1ca801282bc98f975fee8e6bab850a6bcf23afc5a4d925dcaffc38f
SHA51213d5bcfd76286791ca170c456cea57ffbce3729ae2ecd5c5a86bcc2defb84fca2b1dfeef02cfeef1a7f4f06d9e978c08a1e0eee25290f509d79fa8ac34c3964e
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB