Overview

overview

6

Static

static

01ef8ae620...f7.exe

windows7_x64

6

01ef8ae620...f7.exe

windows10-2004_x64

6

Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    23-05-2022 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    01ef8ae620a21d23835f5fd4d63372e33e5db20ce8f8febfc82bf36fbaa83ef7.exe

  • Size

    344KB

  • MD5

    6322cb87da9bf288669900d2d81f6c2d

  • SHA1

    276de4877c6cbce1142b30d7409560b6e6ec8e08

  • SHA256

    01ef8ae620a21d23835f5fd4d63372e33e5db20ce8f8febfc82bf36fbaa83ef7

  • SHA512

    65e28e35dee790cb21fa33c4e6ea3e3d5e6a16a507c978a1b5add6f96430c6a626f83c054fcb544e6ced8c1f9889ac97d40196f2941ba04b8d738b3df0b44d78

Score
6/10
discovery

Malware Config

Signatures

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\01ef8ae620a21d23835f5fd4d63372e33e5db20ce8f8febfc82bf36fbaa83ef7.exe
    "C:\Users\Admin\AppData\Local\Temp\01ef8ae620a21d23835f5fd4d63372e33e5db20ce8f8febfc82bf36fbaa83ef7.exe"
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:1852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1852-54-0x0000000000400000-0x0000000000472000-memory.dmp

    Filesize

    456KB

    Download

  • memory/1852-56-0x00000000753B1000-0x00000000753B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1852-57-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

    Download