Overview

overview

10

Static

static

10

9544bb44a2...34.exe

windows7_x64

6

9544bb44a2...34.exe

windows10_x64

6

Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29-01-2022 19:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9544bb44a22d6b3d15429fd0658cc6acc1e9379f0dcd659f9847f15b1effa934.exe

  • Size

    95KB

  • MD5

    897fc3a65f84e1c3db932965a574d982

  • SHA1

    2873f5215cd6e62b4b0a12861fce64685e557fdf

  • SHA256

    9544bb44a22d6b3d15429fd0658cc6acc1e9379f0dcd659f9847f15b1effa934

  • SHA512

    fb6f924f30bd00566a1f0421c8d9439cc0342a156225ec7bc82141bcc42bcbb62ecb616340a80ae1142c0b612ca9579955f0a12d7e372774772621783a890b66

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9544bb44a22d6b3d15429fd0658cc6acc1e9379f0dcd659f9847f15b1effa934.exe
    "C:\Users\Admin\AppData\Local\Temp\9544bb44a22d6b3d15429fd0658cc6acc1e9379f0dcd659f9847f15b1effa934.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1900

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1900-55-0x00000000760F1000-0x00000000760F3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1900-56-0x0000000000940000-0x0000000000941000-memory.dmp

    Filesize

    4KB

    Download