Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14-03-2024 00:21
General
-
Target
c7375a5fc0b3d9a5dacde7beccecfba6.exe
-
Size
490KB
-
MD5
c7375a5fc0b3d9a5dacde7beccecfba6
-
SHA1
bf7ea12010c9d3a6d8c09cd213810c99da812006
-
SHA256
2ee232ef51dce915cc0ac5e3911d990f6a72059dfb8c9fce7ae16625ac848da3
-
SHA512
637da4794a1b0cde9d558e37f1ff9dbdca427cd6f922c147444fa6c3b421a808e36f8a4eb24c7d438835d75e669ba8fed021b4c846f16d43ead7f1d2f0057f0c
-
SSDEEP
6144:6xGIi+Q5RBvHyBnk3o83xbNlMEnFqbFuk+4xoFltJ:PdmnkRlMkFqpukhav
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7375a5fc0b3d9a5dacde7beccecfba6.exe"C:\Users\Admin\AppData\Local\Temp\c7375a5fc0b3d9a5dacde7beccecfba6.exe"1⤵
- Drops file in Windows directory
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Dpavaa.exeC:\Windows\Dpavaa.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
490KB
MD5c7375a5fc0b3d9a5dacde7beccecfba6
SHA1bf7ea12010c9d3a6d8c09cd213810c99da812006
SHA2562ee232ef51dce915cc0ac5e3911d990f6a72059dfb8c9fce7ae16625ac848da3
SHA512637da4794a1b0cde9d558e37f1ff9dbdca427cd6f922c147444fa6c3b421a808e36f8a4eb24c7d438835d75e669ba8fed021b4c846f16d43ead7f1d2f0057f0c
-
Filesize
344B
MD508f2cbdcb0817c1edaa561ffe68eb244
SHA1c085cba29de3bb5b493b404bb4c72b14dabeb585
SHA256272bbeab4a3f7d20ebee6969a3354f253e3fdf49e0bcf4f97f89dfb007343195
SHA512664feb325b0246159b5d75dcf2a7c9fbcdad64c9ec4c29bdd23b8bb53b0ec1c9cc3face1e9aa0ca7e9427edccf9f594508c2a755b32628ca46d32dac61c5556d
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
496KB
-
Filesize
496KB
-
Filesize
228KB
-
Filesize
496KB
-
Filesize
228KB
-
Filesize
228KB