Overview

overview

4

Static

static

ed14687085...bd.exe

windows7_x64

4

ed14687085...bd.exe

windows10_x64

4

Resubmissions

29/10/2021, 07:54

211029-jrj1gschc3 4

29/10/2021, 07:48

211029-jnellahfbl 4

Analysis

  • max time kernel
    131s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    29/10/2021, 07:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe

  • Size

    297KB

  • MD5

    ebc2661a409a3a743bba237ba1bfc4e8

  • SHA1

    1d9052ce97f4f127f2626b2ff2ee106b4f8b9a70

  • SHA256

    ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd

  • SHA512

    c7999fa0449fd98bd4869327189688942d3812d2d127d4e34173194af11dc2436dcd8a3fef025f5c6075372e0bccf45b859a5d2559d71c100f3281046d0ab1a6

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe
    "C:\Users\Admin\AppData\Local\Temp\ed1468708546ef5f94f9af204ebd2e0093deb9839704fa17dbf1328f037f86bd.exe"
    1⤵
    • Drops file in Program Files directory
    PID:268
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\message_to fmiint.log
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:812
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1144
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4e0
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1228

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/812-55-0x000007FEFB5C1000-0x000007FEFB5C3000-memory.dmp

      Filesize

      8KB

      Download