Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
02/10/2022, 22:59
General
-
Target
1819c46707d71a3b60345361e6ea5a1b3e67bc4c49d19670bc48b73e4a5bdaac.exe
-
Size
31KB
-
MD5
63364c29e23714a91c8454eadbef2c00
-
SHA1
4ef1e5e4c1fa5549bbe10e3fc94c1070c29d6835
-
SHA256
1819c46707d71a3b60345361e6ea5a1b3e67bc4c49d19670bc48b73e4a5bdaac
-
SHA512
64f5c813f0bde11e8792340c4de0550379f2281a7842da492a60e39b0e0e506a7bd9f0801aa9294f3553b72ca76abf560cbafc0ff22d31b494c4161bd21df417
-
SSDEEP
768:lK2kM7P9EiriCvBTJ0IOfupbtq3Q+OAlmuvcs7h:lK1LCvBl0IOWpbt7+OA3vx
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1819c46707d71a3b60345361e6ea5a1b3e67bc4c49d19670bc48b73e4a5bdaac.exe"C:\Users\Admin\AppData\Local\Temp\1819c46707d71a3b60345361e6ea5a1b3e67bc4c49d19670bc48b73e4a5bdaac.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
-
Filesize
272KB