Analysis
-
max time kernel
64s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 04:31
General
-
Target
d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6.exe
-
Size
140KB
-
MD5
02a93781de1b642b89e9617ae9e1e733
-
SHA1
dfd8eed9bab5377c2155c310ea610f28d85ded38
-
SHA256
d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6
-
SHA512
2587c1efe70d923f0e8bf399733eea61d20f68fe885686167262e6a0f2c7b48f88be5ed0aff7d1431afede0f93660d5c02afa62581e62e81ac7ab394ed30f277
-
SSDEEP
3072:F/nU3TQCUKnNlF7ZrHRiaL9qJdZre4/6SRkBK0IocitaoLBms:W38Cb7pqtK42BK0ltpdm
Malware Config
Signatures
-
Modifies security service 2 TTPs 4 IoCs
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 2 IoCs
-
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Drops desktop.ini file(s) 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 18 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 6 IoCs
-
NTFS ADS 18 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6.exe"C:\Users\Admin\AppData\Local\Temp\d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6.exe"C:\Users\Admin\AppData\Local\Temp\d426c1111731c93fabcb8e78d9bfd62ac31b391033a6117d02efcbb0db5e40a6.exe"3⤵
- Modifies security service
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD58425184120e67fa09c8a9f7571a7bcbe
SHA1fa6908b35d8067f0e10869d590ba050a17408e2d
SHA256f6080e679a2ecc687efc9bba0427eb9af582d0e273f2fb71128ad2d8e7370f90
SHA512b60ae3a1811ce174774155f303855ed9f70781f633405136c979d642df112bb2ec2b17cfaed6c2f5a6fc0a1e47535c9f9ddc3970808ceac4e99d1671a2cde65e
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
188KB
-
Filesize
8KB
-
Filesize
188KB
-
Filesize
188KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
240KB
-
Filesize
352KB
-
Filesize
112KB
-
Filesize
112KB
-
Filesize
188KB