0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da | Triage

Analysis

max time kernel
4294180s
max time network
122s
platform
windows7_x64
resource
win7-20220223-en
submitted
24-02-2022 15:34

Sharing

Report Analysis Logs

General

Target

0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
Size

114KB
MD5

84ba0197920fd3e2b7dfa719fee09d2f
SHA1

912342f1c840a42f6b74132f8a7c4ffe7d40fb77
SHA256

0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da
SHA512

bbd4f0263abc71311404c55cb3e4711b707a71e28dcc1f08abd533a4c7f151db9cc40697105d76f1c978000e8fa7aa219adb65b31fb196b08f1ae003e04b9d23

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\jldr	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
File opened for modification	C:\Windows\system32\Drivers\jldr	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
File created	C:\Windows\system32\Drivers\jldr.sys	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 0	1220	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
Token: SeBackupPrivilege	1220	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
Token: SeLoadDriverPrivilege	1220	0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe

C:\Users\Admin\AppData\Local\Temp\0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe
"C:\Users\Admin\AppData\Local\Temp\0385eeab00e946a302b24a91dea4187c1210597b8e17cd9e2230450f5ece21da.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download