Analysis
-
max time kernel
48s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
07/07/2024, 03:09
General
-
Target
3862431768357d168771fb7b82de20d0N.exe
-
Size
33KB
-
MD5
3862431768357d168771fb7b82de20d0
-
SHA1
4b83ed7efdbe7281b7ab827d8baa613a266ecfe3
-
SHA256
3dd0058415627fd8931b04605dc1e53ea610950aa7b8716e711cac0f53a198ea
-
SHA512
ee1c48ff9e0e5986b16139b09f0141ab85814570bfe447273ede0ecf1c421bce5b717aa13e07aef8486f4b4630928d3f641ee14a4ee2bf3a497e6de3db4606a7
-
SSDEEP
768:UEzNbLcQ9qQuVriDMuyuruTD0qB77777J77c77c77c7nOT0BcfqSxi:l3h9qQA6hZunrB77777J77c77c77c7Oi
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification 2 IoCs
-
Disables Task Manager via registry modification
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Modifies system executable filetype association 2 TTPs 2 IoCs
-
UPX packed file 35 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops file in System32 directory 12 IoCs
-
Drops file in Windows directory 25 IoCs
-
Modifies registry class 4 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3862431768357d168771fb7b82de20d0N.exe"C:\Users\Admin\AppData\Local\Temp\3862431768357d168771fb7b82de20d0N.exe"1⤵
- Modifies WinLogon for persistence
- Boot or Logon Autostart Execution: Active Setup
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\control.{21EC2020-3AEA-1069-A2DD-08002B30309D}\øù©ø¤ÑÚ„•.exeC:\Windows\control.{21EC2020-3AEA-1069-A2DD-08002B30309D}\øù©ø¤ÑÚ„•.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\control.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ýþ®ý©Ö¢²ß.exeC:\Windows\control.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ýþ®ý©Ö¢²ß.exe2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD5f8122a598d45b5306e10bd6c66ec97b3
SHA102278887076de3bc9750c1ffb87110d35a094d46
SHA2562cfc92ee2dbafa9d42127f81ac24afc66a94c8dfd0c3a732e3dc3116369d075d
SHA51205b0a45dc391be2f07fb7f9617bba791a83bee62fea8804e1b92593b1d11d579e9ab4628bb44ac121bf4683d6087a3fcff807737a97a54cdf0e572fdc9435e82
-
Filesize
37KB
MD55b048f6acc54f7472b9163337ec3ec33
SHA19c240d26c38e5b400af41ce9702ba2be128b44d9
SHA256985e7da32f44245b6ec96eb07ceb3960010cf0531574c7c7873e7c852569d24e
SHA5122a2a4213a850b02953a0bc8df5682346a0181d3ffb1aa033d6ae069975ff4e5302393cfec2e90262623676718ed2ee361cb3a630eb3a7d46e505a99ad2a3b3dd
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
136KB