Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13/03/2024, 14:03
General
-
Target
c60f759ab51cd29679d9a5269ea5047c.exe
-
Size
444KB
-
MD5
c60f759ab51cd29679d9a5269ea5047c
-
SHA1
df0d339c51c281e362fbc947fa8e134f46c47cb4
-
SHA256
583023b007db4e7d64b4c52fa0049794698941198977b3f7eeb6b67ef00d9c86
-
SHA512
a623a76fb60bd7eb289329c0fbd09c876e09f6a70fd5624c7c745ba81274b0e21ee14691ff6da6479bad2e270515c4659f11d8dcc00c571e7f9ad07096aed49d
-
SSDEEP
12288:b9RTv7UCh6Ww+LroDN4XHfcaOD9cI/04tDv2e4:b991cp+LW4XaB
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c60f759ab51cd29679d9a5269ea5047c.exe"C:\Users\Admin\AppData\Local\Temp\c60f759ab51cd29679d9a5269ea5047c.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pO42900DlKmN42900\pO42900DlKmN42900.exe"C:\ProgramData\pO42900DlKmN42900\pO42900DlKmN42900.exe" "C:\Users\Admin\AppData\Local\Temp\c60f759ab51cd29679d9a5269ea5047c.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD510747e6e3565aa163ce690cbcbf841e2
SHA1483eef63b300c6cc89d7cb1382a337c0444449d0
SHA2563bfdd8fabbd5423f600d0bc738212390ad3a519d9f6151bd9dee46387a3c8c0e
SHA51245251bf88330633722755501e3380416680b316534ecf5853dcbeda4c286e905e0fa99dfdb2b4f9d01c14bea414c5d153c17596dbc1e78c4aad31e85612266a5
-
Filesize
444KB
MD543a8c08c0c8da851172d328137a2d99e
SHA1fbb1e5b19365bb777a8fec76377ddc5b512771aa
SHA25694e56dcc9b783165251fffe40268bf877e47f4e234974bbd9752ed247707078e
SHA512317b010cf611b97e5e1f0ea103a8e1209aaf86cbe22c3f064dfb41cb643433f01890dd76c1041be06ea4584018602e77de1a3cd30285e39592132cfb14ce80ba
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB