Analysis
-
max time kernel
51s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
14-06-2024 13:19
General
-
Target
ddv.exe
-
Size
853KB
-
MD5
c581187d51ca3b1f7ccf3b7e4ca5c7fb
-
SHA1
a6ab6616689a0030fd7cbee89e380a8bb9a9a146
-
SHA256
f431ef3e225cccee2e5a0c14a5421b636e2371fd5d86869f795f73bcfe200a79
-
SHA512
8357ef5bb070a762de3211f73aebb72140f90b522383b26c8d491cdcf594f05214430ace1a884dd6f599b87bc0754ce0cdfb51b4b505e872bc405f65cf36d345
-
SSDEEP
12288:brtfG+RxIf3Yu0Cp5WerP+52B4gdEiz3j4cgKwL6Ix7fsL9X4DS+2GN+mCxW5:HtOV/R0ervqXD+bxA
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 58 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddv.exe"C:\Users\Admin\AppData\Local\Temp\ddv.exe"1⤵
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 11362⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB