Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    20-10-2021 17:41

General

  • Target

    Setup.exe

  • Size

    119KB

  • MD5

    5fa26e5f727057a355a57253b451f1c2

  • SHA1

    905fa3e581f8b2b4e7a025851bf75fd1d506313a

  • SHA256

    bba9c79625e584f537b28492801b0d073408b2876a8500285205c99a2c0e8261

  • SHA512

    2ca57d69a6b538fc18de911f7e493d4190002f3bb5d5fb74efc57e0d9b60ec967c45cdc02c5f91a2af4c3104053898076da190ed53b515e78122e7f7a0bb0026

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1776-53-0x0000000076851000-0x0000000076853000-memory.dmp
    Filesize

    8KB

  • memory/1776-54-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
    Filesize

    4KB

  • memory/1776-56-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
    Filesize

    4KB