Overview

overview

10

Static

static

10

06158ea968...1c.exe

windows7_x64

6

06158ea968...1c.exe

windows10_x64

6

Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29-01-2022 18:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c.exe

  • Size

    88KB

  • MD5

    5371d2984cbd1ae8283f9ae9eeee718d

  • SHA1

    7ddd331686d6b26dc779645a51c7f7eabb655a74

  • SHA256

    06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c

  • SHA512

    18bddf4ab2338f414c13273c588a55c7e6861a6debca8e4540e82e050204e9aff6a137cf997e2131c6f716d82ebabaa24bedcb5489640209d603c944a2d65450

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c.exe
    "C:\Users\Admin\AppData\Local\Temp\06158ea9684f86faee3e0d09810f78f1c9be304f92a9d13cf908995dec12741c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1212

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1212-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1212-55-0x00000000020B0000-0x00000000020B1000-memory.dmp

    Filesize

    4KB

    Download