Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/07/2025, 19:23

General

  • Target

    97468585277b5465ad7f578d479ab1ec4faa3a4fb688586f4862f906aa3654cf.exe

  • Size

    704KB

  • MD5

    6b34dc8f9b2fb0b2f2d128af9269efbb

  • SHA1

    bc3adb223d6c4822c87a7134d4fc7c586cd33473

  • SHA256

    97468585277b5465ad7f578d479ab1ec4faa3a4fb688586f4862f906aa3654cf

  • SHA512

    efaf90f4cb05924049aea436328b27e87e0b00b58f17bf2b2b5f0423527d67b500e4d43dd2fad90e2a11f042e8eb85616469262697ded3b7c2f7a135f1d49c5b

  • SSDEEP

    12288:LSvO2x9mONvKRILSFnOkx2LIaxy6RJ05r:+vO2xJKRI2FOkx2LFEF

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Unexpected DNS network traffic destination 4 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops file in System32 directory 5 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97468585277b5465ad7f578d479ab1ec4faa3a4fb688586f4862f906aa3654cf.exe
    "C:\Users\Admin\AppData\Local\Temp\97468585277b5465ad7f578d479ab1ec4faa3a4fb688586f4862f906aa3654cf.exe"
    1⤵
    • Unexpected DNS network traffic destination
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5572
  • C:\Windows\Syswow64\7630e797
    C:\Windows\Syswow64\7630e797
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1124

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\SysWOW64\7630e797

          Filesize

          704KB

          MD5

          a9d7c9124d0c5f64c1221c0f48016bcc

          SHA1

          833323ade883a69a57b244043872e8fa1529f037

          SHA256

          f9defcacde5098df6ecf9c0bd44c99f3b4544cfb08060915757c566d0bd3a022

          SHA512

          15abe6cfb7c3689237abd0ed5b7e1f861822360ea03f8f2228b35889883c789a6015716098a9bb84681250194d3fd27aa3d7d8bd410a5df5b491d2e008c06ae8

        • memory/1124-4-0x0000000000DA0000-0x0000000000E03000-memory.dmp

          Filesize

          396KB

        • memory/5572-0-0x0000000000C30000-0x0000000000C93000-memory.dmp

          Filesize

          396KB