Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
17-04-2024 14:27
General
-
Target
VC_Redist.86x.exe
-
Size
76.4MB
-
MD5
7a5033c55b79ff312e386b82b595b79a
-
SHA1
fca8752eb08f13e81d6c36a2e02c3e44413c7381
-
SHA256
f6c65ad0928c2855ca9eceb44957e3fb6a634d0c2ff4b4d595491dd52ddb1b65
-
SHA512
0c8b2360d72dd1e8a69ec2f8100762ce18b9826d891e8eb6bf8d0eb5819c713fe8a07fae01f074c103afb33c6389b16f9d3f16e3dcad7edd6f204ee3180d9c4e
-
SSDEEP
1572864:NviEZjFAWSk8IpG7V+VPhqYdfME7mjx6iYweyJulZUdgu0WV6jYm11qZ9U3:NvZZmWSkB05awcfQtnpuK0cmc9U
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 58 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\VC_Redist.86x.exe"C:\Users\Admin\AppData\Local\Temp\VC_Redist.86x.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VC_Redist.86x.exe"C:\Users\Admin\AppData\Local\Temp\VC_Redist.86x.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11242⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD573ecc8d4decf6f198d6505bde482e37a
SHA1ed30f5bd628b4a5de079062ea9b909b99807021c
SHA256b598545be6c99f7db852a510768ecf80ed353fad3989af342bc6faf66fd64648
SHA51256923c477d35680aed73980e0404768f841da868ca11f39888caff0fc06f4ae906551b4bd47f98dda2cc2d81ea9eed17fa7c17aa59d4d7c37510ba24d7ac5976
-
Filesize
3.3MB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
6.8MB
-
Filesize
4KB