Overview

overview

10

Static

static

10

17a1cec5b8...48.exe

windows7_x64

6

17a1cec5b8...48.exe

windows10_x64

6

Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29-01-2022 18:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17a1cec5b8ce358f8a0c43ac7a16292e2b455a79ba62aec1e24ac0a51427cf48.exe

  • Size

    125KB

  • MD5

    51c57b0366d0b71acf05b4df0afef52f

  • SHA1

    18fcd5ca1236e67c4526fb4b5e009be97bded8db

  • SHA256

    17a1cec5b8ce358f8a0c43ac7a16292e2b455a79ba62aec1e24ac0a51427cf48

  • SHA512

    b81b336ce8d9732307287e691fb6d678eab77a9a58423ee4c4ce6a5673a5bf26adbb6f4c282f867cad584c1b5ebf4c6c27ce530d3189b10a178ffe7adb5aaec6

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17a1cec5b8ce358f8a0c43ac7a16292e2b455a79ba62aec1e24ac0a51427cf48.exe
    "C:\Users\Admin\AppData\Local\Temp\17a1cec5b8ce358f8a0c43ac7a16292e2b455a79ba62aec1e24ac0a51427cf48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1588

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1588-54-0x0000000076151000-0x0000000076153000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1588-55-0x0000000000B80000-0x0000000000B81000-memory.dmp

    Filesize

    4KB

    Download