Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
23-05-2024 02:40
General
-
Target
7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe
-
Size
578KB
-
MD5
249b72362af18a1d8415e2545a4f9200
-
SHA1
7dd4cd8c6d8c2624f2341a8a3e9bf6da9d2f4030
-
SHA256
7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211
-
SHA512
f52824d8a14a4afb8eb1ef4fa3077c9e3475fca0c1abfa33ce0a243c6ca62d442d7740fc88683ef4f1ae3426c92d2cddae0d2adb5024e4e721d5d75fc4617071
-
SSDEEP
12288:soH/uLJOyo937vGFWxwFJI+yeuVb8r+ZP712Ii+51cjVWtVj5J:n2JOt934J7Z6bQaj1BvUm9J
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Drops file in System32 directory 2 IoCs
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe"C:\Users\Admin\AppData\Local\Temp\7a11cde31d77925e64000e460b65929624b3934cc8291856263deca83eb76211.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 3402⤵
- Program crash
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
644KB
MD56bc87b3aba6d04608f8d318872437753
SHA1d10ba634992b372f4814eeb4f95c90f3736b0fdf
SHA256f9286a9dff3d301e2d4162a464a0d432d270ce376755ec012d123b4b54efa162
SHA512b40f3a2e205ac42e8b1bade2546cead3fef3c47140072e529dae24659addb0e61f866dc8f65919113e3a255f7084c14646336f3358f3b0ecef39b0dbb6af70f3
-
Filesize
592KB
-
Filesize
412KB
-
Filesize
412KB
-
Filesize
592KB
-
Filesize
656KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
656KB