Task
task1
Task
task2
General
-
Target
Exes_0679ff8965a354cbe614a19cb8d2844b.exe
-
Sample
190801-a1aw49r1b6
-
SHA256
c27b2d312a9e203b0fca4df49aa1d9ef1c974764f6d46eaa85fba3616e61414a
Score
N/A
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 TTPs 1 IoCs
description Token: SeDebugPrivilege -
Modifies Winlogon for persistence 2 TTPs 1 IoCs
description \REGISTRY\USER\S-1-5-21-1548117458-596549244-604853198-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\EwmxaE49afjah0c4\\bkV0QEpy0YUS.exe\",explorer.exe" -
Suspicious use of WriteProcessMemory 1 TTPs 1 IoCs
description pid PID 1152 wrote to memory of 1844 1844 -
Suspicious behavior: EnumeratesProcesses
-
Suspicious use of SetThreadContext 1 IoCs
description pid PID 1152 set thread context of 1844 1844