Resubmissions

07-02-2022 00:34

220207-aw81qsdce2 10

Analysis

  • max time kernel
    163s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    07-02-2022 00:34

General

  • Target

    Abjects.exe

  • Size

    51KB

  • MD5

    ce328046ab3836eef7177159d6e080af

  • SHA1

    596a87e18b4d9789c6fd167ac90036560f4382bc

  • SHA256

    f14535ebeec9ecd43865283cdbdcf4a29548055d64977da1d07255dd8bf00edf

  • SHA512

    27edd18f8f14b63f4ff62ebb0c856590dd7c255fd8d1c025d0ab547761dc7b486b8dc559443ea324ada54019f17e11917fb1712eaa9de53797cb09f61b7db0a2

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Abjects.exe
    "C:\Users\Admin\AppData\Local\Temp\Abjects.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3588
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3588-130-0x0000000000590000-0x00000000005A4000-memory.dmp

    Filesize

    80KB

  • memory/3588-175-0x0000000004F20000-0x0000000004F96000-memory.dmp

    Filesize

    472KB

  • memory/3588-179-0x0000000004ED0000-0x0000000004EEE000-memory.dmp

    Filesize

    120KB

  • memory/4700-263-0x00000155AA530000-0x00000155AA540000-memory.dmp

    Filesize

    64KB

  • memory/4700-264-0x00000155AA590000-0x00000155AA5A0000-memory.dmp

    Filesize

    64KB

  • memory/4700-265-0x00000155AD2A0000-0x00000155AD2A4000-memory.dmp

    Filesize

    16KB