Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 15:53
Behavioral task
behavioral1
Sample
External.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
External.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
External.exe
-
Size
10.3MB
-
MD5
7d320a5d8423d9dc416970adfade2ee5
-
SHA1
b99fc56c3f36c6a63a7008775f7d65b78d047eba
-
SHA256
cda50f53bb85fca493d73810e5fa36f325d9d02abeb8fe8b4507d61d50d28178
-
SHA512
f242c6f0c6639cd003c44aeef5710f1d629f1eef3ffcb77728b598df6eac6126b323de29307ad7b6b1ee2d090f3380ae50dfe3de0733197ff82c3e7c2a3242d8
-
SSDEEP
196608:UWEk1CtNpVEo+2XMCHGLLc54i1wN+ojXx5nDasqWQ2dTNUGdJP6+lm+iITxQmb6V:NEk1Ct/VEb2XMCHWUjAjx5WsqWxT9fTU
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2068 External.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3004 taskmgr.exe -
Suspicious use of FindShellTrayWindow 40 IoCs
pid Process 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious use of SendNotifyMessage 40 IoCs
pid Process 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe 3004 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2068 2520 External.exe 31 PID 2520 wrote to memory of 2068 2520 External.exe 31 PID 2520 wrote to memory of 2068 2520 External.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\External.exe"C:\Users\Admin\AppData\Local\Temp\External.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\External.exe"C:\Users\Admin\AppData\Local\Temp\External.exe"2⤵
- Loads dropped DLL
PID:2068
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3004
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5166cc2f997cba5fc011820e6b46e8ea7
SHA1d6179213afea084f02566ea190202c752286ca1f
SHA256c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
SHA51249d9d4df3d7ef5737e947a56e48505a2212e05fdbcd7b83d689639728639b7fd3be39506d7cfcb7563576ebee879fd305370fdb203909ed9b522b894dd87aacb