Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-07-2024 16:54
General
-
Target
passfab-for-excel.exe
-
Size
29.8MB
-
MD5
68995620bc86cf373d3f4747f1627f8b
-
SHA1
ddbf743a66ad64650c57ebd5fa7eb2c0ed3f439e
-
SHA256
1da8cb4d0f4df4cc1dff103c53d620897927326a7f91b2ad84baedd1f564c6ba
-
SHA512
9c5af025f898e1fdf61cc68989ce173d5d324b72cd79477638b53c5807552feacc4397a629fe97b7b227a287ed8b7b0dba010925a70110fa9e769a1336caa33a
-
SSDEEP
786432:dkX02BYuGGAA1uendMbXrMPhhXRw/JVQmjFo69gEh4c:SXNBpJ1uedsrAhVRwR+mX9gSn
Score
4/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\passfab-for-excel.exe"C:\Users\Admin\AppData\Local\Temp\passfab-for-excel.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-QHIQK.tmp\passfab-for-excel.tmp"C:\Users\Admin\AppData\Local\Temp\is-QHIQK.tmp\passfab-for-excel.tmp" /SL5="$5014E,30644949,255488,C:\Users\Admin\AppData\Local\Temp\passfab-for-excel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD513a1ee6075fda4e00f288377ccfc387f
SHA138214bd25afc57d31a757818ce6a9371a1488829
SHA2561b40e13a04d1f70336e733fa450e0797bfa3a9e1df5ac040b3dda46b54a6efe9
SHA5126bb410df6ea152dc0e12bba16ae27209384b31459c7fff1656b46629dead7efb92dbd587349552ac0324145962a7ad33a470284d698d53079b6691e3ec1a281c
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
68KB
-
Filesize
288KB
-
Filesize
288KB
-
Filesize
288KB