Overview

overview

10

Static

static

10

49096cb191...25.exe

windows7_x64

6

49096cb191...25.exe

windows10_x64

6

Analysis

  • max time kernel
    148s
  • max time network
    158s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    29-01-2022 18:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    49096cb1914b4e9cf0088d60185a48e0242f3b3e4c3a7aab2cfc25aa98270025.exe

  • Size

    56KB

  • MD5

    5b4361e6a6117e9f7189a564f46157d7

  • SHA1

    f33f85659806779248b464e43df5ca8ee34d0174

  • SHA256

    49096cb1914b4e9cf0088d60185a48e0242f3b3e4c3a7aab2cfc25aa98270025

  • SHA512

    49e697af58c4af3ee64512cb33a6e69680d7d17ecab7a16388515244d60d607896bc15d41cf9ebcf0be0695f335121164838de6ad8671a3af39c44e13bb8d4f6

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49096cb1914b4e9cf0088d60185a48e0242f3b3e4c3a7aab2cfc25aa98270025.exe
    "C:\Users\Admin\AppData\Local\Temp\49096cb1914b4e9cf0088d60185a48e0242f3b3e4c3a7aab2cfc25aa98270025.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3716-118-0x00000000022D0000-0x00000000022D1000-memory.dmp

    Filesize

    4KB

    Download