Overview

overview

10

Static

static

10

06ffb7bbd7...da3906

linux_amd64

06ffb7bbd7...da3906

linux_mipsel

06ffb7bbd7...da3906

linux_mips

154080c584...95.msi

windows7_x64

8

154080c584...95.msi

windows10_x64

8

1650ced30c...c5.exe

windows7_x64

1650ced30c...c5.exe

windows10_x64

1a70a7de8a...4a.exe

windows7_x64

8

1a70a7de8a...4a.exe

windows10_x64

8

ISSUES INV....1.exe

windows7_x64

10

ISSUES INV....1.exe

windows10_x64

10

350fbd43ce...ed.exe

windows7_x64

350fbd43ce...ed.exe

windows10_x64

44faf11719...12.exe

windows7_x64

1

44faf11719...12.exe

windows10_x64

1

4853dc09bb...5f6.js

windows7_x64

1

4853dc09bb...5f6.js

windows10_x64

1

4ba637df90...3f4a9e

linux_amd64

4ba637df90...3f4a9e

linux_mipsel

4ba637df90...3f4a9e

linux_mips

4f8c1840d6...92df06

linux_amd64

4f8c1840d6...92df06

linux_mipsel

4f8c1840d6...92df06

linux_mips

623534bf15...72.vbs

windows7_x64

10

623534bf15...72.vbs

windows10_x64

10

65df637db2...00083b

linux_amd64

65df637db2...00083b

linux_mipsel

65df637db2...00083b

linux_mips

717ad3ee2b...47.dll

windows7_x64

10

717ad3ee2b...47.dll

windows10_x64

10

71ba20bdd8...99.pps

windows7_x64

10

71ba20bdd8...99.pps

windows10_x64

10

Analysis

  • max time kernel
    10s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    20-07-2021 13:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe

  • Size

    31KB

  • MD5

    3a3d600ad9c9615f18003620a1bf5f28

  • SHA1

    7b3b3b8aa37ca78c46ec2774784cf51d190733e8

  • SHA256

    44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112

  • SHA512

    b534f6f93c6679f9cf24361f763859fce6d6fadc684e35de7f9e90f6c2b7427d54204e1e30818bfe67e18c8594cdfde8cd398900b1fbb94f413ea6624826dc67

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe
    "C:\Users\Admin\AppData\Local\Temp\44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/792-60-0x0000000000C70000-0x0000000000C72000-memory.dmp
    Filesize

    8KB

    Download
  • memory/792-61-0x000007FEF2360000-0x000007FEF33F6000-memory.dmp
    Filesize

    16.6MB

    Download