Analysis

  • max time kernel
    154s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    05/02/2022, 15:54

General

  • Target

    51710ac663a6fd3bc7f166045d4cb38b1e1796195b4aab057b4133df8db9ef8b.exe

  • Size

    222KB

  • MD5

    88c736232fb454d269f854e9f16558cf

  • SHA1

    e16871e6a6c51b39b43461c996d5146ec56b51d6

  • SHA256

    51710ac663a6fd3bc7f166045d4cb38b1e1796195b4aab057b4133df8db9ef8b

  • SHA512

    4f4da89dbc370714e16d06b742ecdde06b21c860b20d0690470842e856fd96ee75e81de519e1b3d072d081aa75e3897935b5ba7c010f3fdf7700fd64e6ae0a02

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51710ac663a6fd3bc7f166045d4cb38b1e1796195b4aab057b4133df8db9ef8b.exe
    "C:\Users\Admin\AppData\Local\Temp\51710ac663a6fd3bc7f166045d4cb38b1e1796195b4aab057b4133df8db9ef8b.exe"
    1⤵
      PID:4748
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:5024

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4748-143-0x0000000000530000-0x000000000055A000-memory.dmp

            Filesize

            168KB

          • memory/5024-142-0x0000026D17030000-0x0000026D17034000-memory.dmp

            Filesize

            16KB