Overview

overview

10

Static

static

10

56ec7c81e2...2c.exe

windows7_x64

6

56ec7c81e2...2c.exe

windows10_x64

6

Analysis

  • max time kernel
    150s
  • max time network
    164s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29-01-2022 17:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe

  • Size

    66KB

  • MD5

    a3aa3a12d81c9862b18f83a77d7215ca

  • SHA1

    6e3e89e2f3d096ee09d4bf88410e80ef17536ab7

  • SHA256

    56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c

  • SHA512

    899dc5b47f1f5df3fbd0558438b365857f457cc99505fe80a5d6cb0a81fe760ae8aed8bb75c3b112e472bc9c1231bc11393eb63eb12d40688a85b42d3483e010

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe
    "C:\Users\Admin\AppData\Local\Temp\56ec7c81e26fbbab76fa82cce7b9efc16722bb0ff918cde091559b2d2dd7ee2c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1192

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1192-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1192-56-0x0000000000B20000-0x0000000000B21000-memory.dmp

    Filesize

    4KB

    Download