Analysis
-
max time kernel
4294180s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
25-02-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
-
Size
114KB
-
MD5
f1a33b2be4c6215a1c39b45e391a3e85
-
SHA1
9518e4ae0862ae871cf9fb634b50b07c66a2c379
-
SHA256
06086c1da4590dcc7f1e10a6be3431e1166286a9e7761f2de9de79d7fda9c397
-
SHA512
0fc69b926a03abc720e6fb05083db8d7bf6107261b54102bfb61025c0ee1ca9fbd7baa0e7d73339a0ea56b84aca329f0a66241cc41dc01d185f15271c82e966a
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
Processes:
06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exedescription ioc process File created C:\Windows\system32\Drivers\jldr 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe File opened for modification C:\Windows\system32\Drivers\jldr 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe File created C:\Windows\system32\Drivers\jldr.sys 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 460 460 460 460 460 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exedescription pid process Token: 0 804 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe Token: SeBackupPrivilege 804 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe Token: SeLoadDriverPrivilege 804 06086C1DA4590DCC7F1E10A6BE3431E1166286A9E7761F2DE9DE79D7FDA9C397.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/804-54-0x0000000074BE1000-0x0000000074BE3000-memory.dmpFilesize
8KB