Analysis

  • max time kernel
    659s
  • max time network
    666s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 22:18

Errors

Reason
Machine shutdown

General

  • Target

    The-MALWARE-Repo-master/Trojan/ColorBug.exe

  • Size

    53KB

  • MD5

    6536b10e5a713803d034c607d2de19e3

  • SHA1

    a6000c05f565a36d2250bdab2ce78f505ca624b7

  • SHA256

    775ba68597507cf3c24663f5016d257446abeb66627f20f8f832c0860cad84de

  • SHA512

    61727cf0b150aad6965b4f118f33fd43600fb23dde5f0a3e780cc9998dfcc038b7542bfae9043ce28fb08d613c2a91ff9166f28a2a449d0e3253adc2cb110018

  • SSDEEP

    1536:ynqAKryDLrASOcRw52sjzIUK7RkYrJ2lrKX:SNdMT8Z8cX

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Control Panel 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\ColorBug.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\ColorBug.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Control Panel
    PID:1864
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2248
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x184
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1896
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:2880

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1864-0-0x0000000000400000-0x0000000000414000-memory.dmp

        Filesize

        80KB

      • memory/2248-1-0x0000000002E10000-0x0000000002E11000-memory.dmp

        Filesize

        4KB

      • memory/2880-2-0x0000000002B30000-0x0000000002B31000-memory.dmp

        Filesize

        4KB