Overview

overview

10

Static

static

ea4b22b19a...28.exe

windows7_x64

10

ea4b22b19a...28.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 18:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe

  • Size

    25KB

  • MD5

    9c8c8f323909f37d2412ac1f1f50d407

  • SHA1

    cc1b07720dfce2d84b68550c878e8ab3ec060607

  • SHA256

    ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428

  • SHA512

    a77d65279950bae9de7e9fce6de314dfd0982c6c2b52535f769bf6792ba800ce6195cad61b064d79398ead271424d4021de691a9e3f8c19058bf8c24db5c6c5b

Score
7/10
persistence

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe
    "C:\Users\Admin\AppData\Local\Temp\ea4b22b19a279f73e049b71ea1295e4d77e0182183ed3ac4715e03d52fa4d428.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2576-130-0x0000000000750000-0x0000000000758000-memory.dmp
    Filesize

    32KB

    Download
  • memory/2576-131-0x00007FFAB4C60000-0x00007FFAB5721000-memory.dmp
    Filesize

    10.8MB

    Download