1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591 | Triage

Resubmissions

24-02-2022 11:19

220224-nfa1naebfr 8

23-02-2022 18:49

220223-xglcfsbah3 8

23-02-2022 18:46

220223-xesczscddl 10

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
23-02-2022 18:46

Sharing

Report Analysis Logs

General

Target

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
Size

114KB
MD5

3f4a16b29f2f0532b7ce3e7656799125
SHA1

61b25d11392172e587d8da3045812a66c3385451
SHA256

1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591
SHA512

32acaceda42128ef9e0a9f36ee2678d2fc296fda2df38629eb223939c8a9352b3bb2b7021bb84e9f223a4a26df57b528a711447b1451213a013fe00f9b971d80

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\jldr.sys	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
File created	C:\Windows\system32\Drivers\jldr	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
File opened for modification	C:\Windows\system32\Drivers\jldr	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 0	1636	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
Token: SeBackupPrivilege	1636	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
Token: SeLoadDriverPrivilege	1636	1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe

C:\Users\Admin\AppData\Local\Temp\1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe
"C:\Users\Admin\AppData\Local\Temp\1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-55-0x0000000076921000-0x0000000076923000-memory.dmp

Filesize
8KB

Download