06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397 | Triage

Analysis

max time kernel
4294180s
max time network
127s
platform
windows7_x64
resource
win7-20220223-en
submitted
25/02/2022, 14:40

Sharing

Report Analysis Logs

General

Target

06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Size

114KB
MD5

f1a33b2be4c6215a1c39b45e391a3e85
SHA1

9518e4ae0862ae871cf9fb634b50b07c66a2c379
SHA256

06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397
SHA512

0fc69b926a03abc720e6fb05083db8d7bf6107261b54102bfb61025c0ee1ca9fbd7baa0e7d73339a0ea56b84aca329f0a66241cc41dc01d185f15271c82e966a

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\jldr	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
File opened for modification	C:\Windows\system32\Drivers\jldr	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
File created	C:\Windows\system32\Drivers\jldr.sys	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found
460	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 0	804	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Token: SeBackupPrivilege	804	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Token: SeLoadDriverPrivilege	804	06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe

C:\Users\Admin\AppData\Local\Temp\06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
"C:\Users\Admin\AppData\Local\Temp\06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:804

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/804-54-0x0000000074BE1000-0x0000000074BE3000-memory.dmp

Filesize
8KB

Download