Overview

overview

10

Static

static

10

9f50b0f990...40.exe

windows7_x64

6

9f50b0f990...40.exe

windows10_x64

6

Analysis

  • max time kernel
    150s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29/01/2022, 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe

  • Size

    87KB

  • MD5

    9e73d275202b02b3f0ed23951fda30da

  • SHA1

    fcc8ac89581e1625a05ef54cee9ce8d3a48a8144

  • SHA256

    9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40

  • SHA512

    bc2a13759e87b6e6bdabdcaaabd6d30204ea86fc1bcb1ee8586f1aa7453247bd4618e206bc126e57129c16f0806251a8243583f1035241c9adc55d81efe037d3

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe
    "C:\Users\Admin\AppData\Local\Temp\9f50b0f990b7f89b105ab2c6d99b6bee93c3963f265ee41176d1854996069a40.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1616

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1616-55-0x00000000763B1000-0x00000000763B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1616-56-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

    Filesize

    4KB

    Download