Overview

overview

10

Static

static

10

06f277d1d6...32.exe

windows7_x64

6

06f277d1d6...32.exe

windows10_x64

6

Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    29/01/2022, 19:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    06f277d1d69550e345a08b34c034e257d5923b9d62a3cb00719aae96debd2332.exe

  • Size

    77KB

  • MD5

    1a1426a94e37e5f3c14cd2b6740e27e1

  • SHA1

    8568bfddfdf948e15934363f891028f0f798ddb5

  • SHA256

    06f277d1d69550e345a08b34c034e257d5923b9d62a3cb00719aae96debd2332

  • SHA512

    76e5ad8991ad6b366d0c6b93fdee29aaf3b3d178a31aa5d514ed8aa4d24531dd41da92ee1ff139628cbc3144a758c732153bf8f06a482a3f6b7fc3b742e5bf62

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06f277d1d69550e345a08b34c034e257d5923b9d62a3cb00719aae96debd2332.exe
    "C:\Users\Admin\AppData\Local\Temp\06f277d1d69550e345a08b34c034e257d5923b9d62a3cb00719aae96debd2332.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1928

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1928-55-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1928-56-0x0000000076511000-0x0000000076513000-memory.dmp

    Filesize

    8KB

    Download