Analysis
-
max time kernel
112s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 07:50
Static task
static1
Behavioral task
behavioral1
Sample
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
-
Size
64KB
-
MD5
76c5b877fb931ed728df30c002bf8823
-
SHA1
16a8a21ef1a30849bedc514e42286de7676db5af
-
SHA256
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91
-
SHA512
3ed1568c7650f536b91bea3de2afaf0e01f81d986c2968d012622fc542c06d536bf5b17e615ecbab0c89dafb600f1f245c84a9f13f45e8e03481a2d51e20728c
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eternity = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe\"" 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
vssvc.exe55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exedescription pid process Token: SeBackupPrivilege 4740 vssvc.exe Token: SeRestorePrivilege 4740 vssvc.exe Token: SeAuditPrivilege 4740 vssvc.exe Token: SeDebugPrivilege 772 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exepid process 772 55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe"C:\Users\Admin\AppData\Local\Temp\55bf0aa9c3d746b8e47635c2eae2acaf77b4e65f3e6cbd8c51f6b657cdca4c91.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-130-0x0000000000870000-0x0000000000886000-memory.dmpFilesize
88KB
-
memory/772-131-0x00000000059C0000-0x0000000005F64000-memory.dmpFilesize
5.6MB
-
memory/772-132-0x0000000005410000-0x00000000054A2000-memory.dmpFilesize
584KB
-
memory/772-133-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/772-134-0x0000000006300000-0x000000000630A000-memory.dmpFilesize
40KB