Analysis
-
max time kernel
39s -
max time network
170s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-08-2021 17:51
General
-
Target
403990C6CBB042F7C1F5E57177272F81.exe
-
Size
1.3MB
-
MD5
403990c6cbb042f7c1f5e57177272f81
-
SHA1
ab9ef44ed7b93ecf7b6c43f23d75a3f2dc9d5a1b
-
SHA256
42af92e5be37c1daddda7672372a39ccebb24d31d2ea65bec2a74dfbc3a4e82c
-
SHA512
cb1adffb69f4ff6a62257325504cebc41d22f41910a41eae9c04ec5327da9f58fb652e79b87f580c7ac6f81f27cf2fba77b4fc3947b27dd59ae376f2d7c57ee5
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\403990C6CBB042F7C1F5E57177272F81.exe"C:\Users\Admin\AppData\Local\Temp\403990C6CBB042F7C1F5E57177272F81.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qtaranl.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE48A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE47A.tmp"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
20KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
8KB