Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-05-2024 17:28
General
-
Target
7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a.exe
-
Size
11.8MB
-
MD5
5f227ea33d9907bd4baf01d8d338982f
-
SHA1
2475beb0899e8c9f1b4e9ddc75a0410743e80607
-
SHA256
7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a
-
SHA512
75a6d052d25cfb57fd866dfc17e67e5dbcfa52f7d0af612740ac1c3656e1927fb839fd6b8c1a36ae0fa98524ab87954e81832b0de844dd496d37c11a8793b089
-
SSDEEP
196608:yk/xL+l4wCekpX3oqoV+0XKIKWUGNEoiN/A4saY636Iydc1IAxHbG6rjYKx0cyMn:ykp2CektYxojtpGNvaYK6IzeANC6PYK9
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a.exe"C:\Users\Admin\AppData\Local\Temp\7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\°åÇÅ´«Ææ΢¶Ë[×îÐÂ]\7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a.exeC:\°åÇÅ´«Ææ΢¶Ë[×îÐÂ]\7c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22B
MD5f47eb11a163f86a374531c400c645bdb
SHA151430dd8857722fef44cbc1d7951a736b8d87f35
SHA2560d4606f972c089788f2ede410ca098db7f5514f7a7cf5431aa518f94d0c4a62a
SHA512a861b75eaca0f06189aab1cef86a1c5db26252d8d906fb92229e5b6d56b245d6c5ba9330e1942f1e1bcb2aa391bbcad1f51e5fdb635668b773845b1bb506d876
-
Filesize
102B
MD593c45aa60c5422e4c835e70a2921c1b0
SHA1a89d008b19ac22b2ceb7c5787b868b14cb2e50f6
SHA2562a282ef7a39b0974b1991046b59c5355b68176204fc7ee33584e0753a5f00999
SHA51227a274f9237292b221de820d432d42879a9ca155028a06507da112068ae1597132d131f7912f3481de8dca2ed38874ea41851b641251d65498d159901d9cff6d
-
Filesize
11.8MB
MD55f227ea33d9907bd4baf01d8d338982f
SHA12475beb0899e8c9f1b4e9ddc75a0410743e80607
SHA2567c1081ac7208565b6448166544600fd579f54e0a8a1b57c248330fd148fdd98a
SHA51275a6d052d25cfb57fd866dfc17e67e5dbcfa52f7d0af612740ac1c3656e1927fb839fd6b8c1a36ae0fa98524ab87954e81832b0de844dd496d37c11a8793b089
-
Filesize
3.7MB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
3.7MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
3.7MB
-
Filesize
44KB
-
Filesize
3.7MB