Analysis

  • max time kernel
    179s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2022 14:02

General

  • Target

    bc13d57582f4328dcfa24b80959ac9f5000a7207c24f881d85ea02af1d2e168e.exe

  • Size

    63KB

  • MD5

    12c5f0f6e275b515c7cfcc26748a5b82

  • SHA1

    08d89712eac855ab59e6c591c020e041ce752376

  • SHA256

    bc13d57582f4328dcfa24b80959ac9f5000a7207c24f881d85ea02af1d2e168e

  • SHA512

    4580953973a8c3b2f4998646848dbf1db5fc22dcae478b57c449b87358c0ff3044d5e0f6b2a81717aa2798b1aae7d48f8171d123cf6292785cbeb8d4c0a64aa8

  • SSDEEP

    1536:3z4aVxdDgtWzYcyKC2sKVOFfhhp9EQMwVJzP5AtTm:3vTdDgXcyZ2LVOzaRwJ9Atq

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc13d57582f4328dcfa24b80959ac9f5000a7207c24f881d85ea02af1d2e168e.exe
    "C:\Users\Admin\AppData\Local\Temp\bc13d57582f4328dcfa24b80959ac9f5000a7207c24f881d85ea02af1d2e168e.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    PID:580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/580-132-0x00000000020C0000-0x0000000002140000-memory.dmp

    Filesize

    512KB

  • memory/580-133-0x00000000020C0000-0x0000000002140000-memory.dmp

    Filesize

    512KB