Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 23:37
General
-
Target
7f44f4a3963a91b85a4eed6d12152c706a8936409fefc56210495ed259eb44fd.exe
-
Size
64KB
-
MD5
34bfba5217ca64941b08ae342a9f10f2
-
SHA1
1c7371ef4e74b44a712fc5572a3f8377e64fbce0
-
SHA256
7f44f4a3963a91b85a4eed6d12152c706a8936409fefc56210495ed259eb44fd
-
SHA512
ce93fae3640b6d2a60ccbfa3e62faafa920bb45abf7f53e1121cc5f39a17e2028ad6a21f12c237e0abc6a057950095505308016f9332a87272584212237f7336
-
SSDEEP
192:ObOzawOs81elJHsc45ecRZOgtShcWaOT2QLrCqwtY04/CFxyNhoy5tF:ObLwOs8AHsc4QMfwhKQLro/4/CFsrdF
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 22 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 11 IoCs
-
Drops file in Windows directory 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 11 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f44f4a3963a91b85a4eed6d12152c706a8936409fefc56210495ed259eb44fd.exe"C:\Users\Admin\AppData\Local\Temp\7f44f4a3963a91b85a4eed6d12152c706a8936409fefc56210495ed259eb44fd.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C7EFC7D7-1DF1-46dd-8880-A152BCB88960}.exeC:\Windows\{C7EFC7D7-1DF1-46dd-8880-A152BCB88960}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16B1BD39-2B67-40ff-8F6D-2BEED0F63449}.exeC:\Windows\{16B1BD39-2B67-40ff-8F6D-2BEED0F63449}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EAE10D49-96E1-49de-AAE7-27A276AF849E}.exeC:\Windows\{EAE10D49-96E1-49de-AAE7-27A276AF849E}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40ABDCC1-EB32-4ec9-BF8C-DC528AF084C6}.exeC:\Windows\{40ABDCC1-EB32-4ec9-BF8C-DC528AF084C6}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EA3E164-1898-488d-8B5A-503FEA8506A6}.exeC:\Windows\{8EA3E164-1898-488d-8B5A-503FEA8506A6}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F233ABF-4676-4013-9305-6CE3F2654FAF}.exeC:\Windows\{4F233ABF-4676-4013-9305-6CE3F2654FAF}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A77DB236-B2BE-4465-AD77-F14DD9A83ACF}.exeC:\Windows\{A77DB236-B2BE-4465-AD77-F14DD9A83ACF}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98735686-5AD0-456f-A919-509784020AAF}.exeC:\Windows\{98735686-5AD0-456f-A919-509784020AAF}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{1A6A0ED0-4E20-4829-937C-CF86F490A7C4}.exeC:\Windows\{1A6A0ED0-4E20-4829-937C-CF86F490A7C4}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{9742371B-3B84-419e-A33B-BC3DD0E46BEE}.exeC:\Windows\{9742371B-3B84-419e-A33B-BC3DD0E46BEE}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\{8F1E9FE3-3BD1-4c75-8433-457C07B0C836}.exeC:\Windows\{8F1E9FE3-3BD1-4c75-8433-457C07B0C836}.exe12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97423~1.EXE > nul12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A6A0~1.EXE > nul11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98735~1.EXE > nul10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A77DB~1.EXE > nul9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F233~1.EXE > nul8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EA3E~1.EXE > nul7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40ABD~1.EXE > nul6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EAE10~1.EXE > nul5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16B1B~1.EXE > nul4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7EFC~1.EXE > nul3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\7F44F4~1.EXE > nul2⤵
- Deletes itself
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5db8fd1c9f82233e03f95e568e0acc3e8
SHA1754445beb8481653da3408bbaa17e3c115040cf0
SHA25621be22e1c4e0ab252c6dc1e92fff3d18cfc3d261c634c873db34d766f91975bd
SHA5124f5eaf3ade7728dbae9d841cf437f3dfe63ac3e3f780785f08c7cfbbb2ac8d50926b5ed861929579ddc63098e0fcf72a07ee4e9df1596d7a47f73d3e13398fe9
-
Filesize
64KB
MD527f971e3851acf517c52b6d97475222a
SHA17a310c3cddda0b58bbc3f5dd43fe7d4578a72ebb
SHA256ef7b78b7269117b1fbe1db3446bf79209fd825aae45a4e4e31f361b1d4e86798
SHA5125d19abbbb81bf3af0f88d2c62dc67c9be2420cf53cf7df9f360038962405eab9cdaae79b5264d20d71f930f50abe3f81e8d380ebe3c1cea11e93485d38e4a8a9
-
Filesize
64KB
MD5baade01f008888338c76fd37b8c82020
SHA1205dc19a6a80749283d048bac5c1ecc826bf384c
SHA2566c9a04efdd4dc6459afd8b8312cce8259f24ac7decaed42000466b797e973fb8
SHA51218b340d25564f6ea664d4fb9093ba11d364df64ed1c6b27a2c31201f163497b65aa97482c867b3d9f92b97e068ae4753c7d018458d5395a2b8befeddae4d2430
-
Filesize
64KB
MD5bd0414e835e61a817f111d79bbe81a3a
SHA1d9c3402fe3fc15104d5aa2ac90107f7adedf14a7
SHA2565dd0e791949f7b2c772b4d7ac0d116cc911ab2e82392dc50739ea7f9ea797c32
SHA51243621e15fe26e5c22befe9248083e8513b81488b80d98400edfb6efd757224ae3988f0034769f54b4d322c6d4c738486b68598473e09857e6db3ae7042eef5c6
-
Filesize
64KB
MD52151d6fbe9f9da25e779a2d062c0cd25
SHA123e1e578a4dc7e2d2d922ed2504a0fe7c7c9306b
SHA256d6a00d4e8bda3f9e3a1b5b364ff6063f241c6afe7184f631fa2b2426211c7956
SHA5124fc9879fa5692ca202fb9c5dfd20c84f9e7fba9621c0e911df9417d00ec1a54e18b08da02bf91495e0aa4c531da57dec6d23f086da902183e907b358bd202ef9
-
Filesize
64KB
MD5331f6829ad6b06789e472cd9bc887aca
SHA1cc337f1f18425e5ffdb5a50a2551de4535cb05b5
SHA2564b7584d18f5c45ff912c04c6504472591afc38ccadc37728472711ffbeb04116
SHA51291520986fa896cc9721d70488faa78b78911fdb3c6f143bf9902cc4723b3178f26cd6d98e3b36205d05fc029fc7b06baeca9f2adc7f98414958284ac4798403c
-
Filesize
64KB
MD571faf47cbcaf5eb18e5e30ad7ecd6938
SHA1c07c0122c208126c52f2a84218f69a1a002b36db
SHA2568618412fd4e3ee28b98f4400f6819a712d7817540f10e5e2a360ea7ac92cc979
SHA51232bd9b1f55a35a072c14d6e67635355a90dd740a4e3000818515779ff853db7ad758c624285cc657873cb05c6ab5e78bc507fb3dbe1f9c125e2ad1b5dfeef290
-
Filesize
64KB
MD5acccfca5f195b59fb287e2642bb3df68
SHA117b76bf977e0fde2d3afe1fc12eff146afa02e2a
SHA25698b1bd27db240e090c9cc7c24ad0018bad38264527cebe63e0fa0dd913b17c2b
SHA512c00d2e31dedf9d98f54a28c0218dc6e7ad43a7758ea42545a8cf4ebed66074d21c97b18756071e20376504a02c743651b0f7712e50f8b6ade161e9c2e8d15d24
-
Filesize
64KB
MD5e662710107231afb903ba04e49cafa64
SHA1b200d725fd39c6f5df267c4a190ccf144fef61ca
SHA256d9f0b658442905a2900df5cf86b69da095f4bae92962431cf4162b73815e32dd
SHA512068ba6c64223c43dde7185f33faea8162132393fa184d87220247ee6b53e5e2b22ccc6b4b842106c17fc4e1ee7aef5f633b33cd0d1ace9db97ffab5fc11f9ab7
-
Filesize
64KB
MD556d4235cc6facf627e0437b4a4755e6e
SHA104a03553b0713a835673d7d3ffd0030245dbcebf
SHA2560be0921c2e84ff1bf8253bc238d77ce9c9e39fffbdc8f420407052882fe2f173
SHA5120b7899ec480ab050b0713bd656cea3b6d7cd52a2456355bc22f4cb8fb454d2a5e062e6fe0c3c067888f3616e4103b07730a8788726040fe166ac52503e584c5e
-
Filesize
64KB
MD55fb5d8f9659b2d631dbdb128530e6a07
SHA1cdd205b1feca210b8b4a6c5147e671ae47cb133d
SHA256ab65ee4b882ba2cfbe260657e092a74b7460cbcf0b039017b9f7ada3c0db666b
SHA512943112ef867d549045cecd36e39e9364eefe7bd4518d2f53874c44407fd883cdaec4ab4bb40664dee7a818aac5dc9ded7c4acfd2eca8d4b2d181e80e253a36cf
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB