Analysis
-
max time kernel
119s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
23/07/2024, 09:41
General
-
Target
9c67c134b9650d78e4dba596d677bfe0N.exe
-
Size
67KB
-
MD5
9c67c134b9650d78e4dba596d677bfe0
-
SHA1
e0fde90501231bb2ed004d15380ecf63d442cb93
-
SHA256
f4d283a12670bef6616dddb2ee28a5aa15b824f2b28a35879163a83d1f5ae23d
-
SHA512
30b11f492d9ab5176822ce90a839c91e18cadd2cdf9b6e4374b6b3af23552a6e1b15742f66e7aa0d0be2883e34ba9d534648a0a1b4ee00d2984efd091aa5263e
-
SSDEEP
1536:1teqKDlXvCDB04f5Gn/L8FlADNt3d1+awA:ulg35GTslA5t3GawA
Malware Config
Signatures
-
Windows security bypass 2 TTPs 4 IoCs
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 4 IoCs
-
Modifies WinLogon 2 TTPs 5 IoCs
-
Drops file in System32 directory 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c67c134b9650d78e4dba596d677bfe0N.exe"C:\Users\Admin\AppData\Local\Temp\9c67c134b9650d78e4dba596d677bfe0N.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unsooror-oged.exe"C:\Windows\system32\unsooror-oged.exe"2⤵
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\unsooror-oged.exeùù¿çç¤3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5a10341b5ad5f60ae301983f006bf5964
SHA12225e6689bf86b84af65ac3fab2feb053c1184b7
SHA2566ab5d47a0b788dab4d4c137b2f98304361918d2b023b50117b44879aa239afae
SHA5129b9828076d061620d05583d088eb9643f00457b4d5187bbae3d480207fd9e9c911135b13e9aeafc044c0d23fffe2eda9c82f48ca3d98f866099d58b9a43d19ac
-
Filesize
69KB
MD5b796d9981d857bb004230d326acacb54
SHA16e16ea69312494c135528f32178a479cf704f7a8
SHA256bf4c78c7c837e9acbca105b59d517ef55e7ab69df74f050c97eb7b25da375c57
SHA5124d1bb86a32900c2c502d927d271c91bff968968353b2e89ee07495f3cc84f0d81933a02610409308942a4bf9eb98bfaa24aca8d5d0978b07aefd5674b1f71c02
-
Filesize
5KB
MD5f37b21c00fd81bd93c89ce741a88f183
SHA1b2796500597c68e2f5638e1101b46eaf32676c1c
SHA25676cf016fd77cb5a06c6ed4674ddc2345e8390c010cf344491a6e742baf2c0fb0
SHA512252fe66dea9a4b9aebc5fd2f24434719cb25159ba51549d9de407f44b6a2f7bce6e071be02c4f2ad6aef588c77f12c00ed415eb54f96dec1b077326e101ce0f4
-
Filesize
67KB
MD59c67c134b9650d78e4dba596d677bfe0
SHA1e0fde90501231bb2ed004d15380ecf63d442cb93
SHA256f4d283a12670bef6616dddb2ee28a5aa15b824f2b28a35879163a83d1f5ae23d
SHA51230b11f492d9ab5176822ce90a839c91e18cadd2cdf9b6e4374b6b3af23552a6e1b15742f66e7aa0d0be2883e34ba9d534648a0a1b4ee00d2984efd091aa5263e
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB