Overview

overview

4

Static

static

be107436ae...5c.exe

windows7-x64

be107436ae...5c.exe

windows10-2004-x64

Analysis

  • max time kernel
    48s
  • max time network
    73s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2022, 06:00

Sharing

Copy URL Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    be107436aefeb709cacda68f85568afb961b48100daa443bf1fca33639a4865c.exe

  • Size

    61KB

  • MD5

    6d33a3e9c6f210fdad707ad426b384ed

  • SHA1

    62cf4e103b5b6d0dfa274d3575462daf5ae95645

  • SHA256

    be107436aefeb709cacda68f85568afb961b48100daa443bf1fca33639a4865c

  • SHA512

    2cade6ae340eb62045c19b534e9338d42421365e50f919bfe76ec47be35c4126bd6c1fda6d9b0237429dab970dfc95079a121b3b17f6981cce53f403a35e6408

  • SSDEEP

    768:G73b/AkarcKB+e5qGq6zfC8mp+9ROlJtDXvYLIS2BUzDZ2ztELn5ZgPmCIFAX4DF:GvUvqGqESGNp2uL7gP1IFfrZ+IvXx

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be107436aefeb709cacda68f85568afb961b48100daa443bf1fca33639a4865c.exe
    "C:\Users\Admin\AppData\Local\Temp\be107436aefeb709cacda68f85568afb961b48100daa443bf1fca33639a4865c.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:916
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:2012
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x54c
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1140
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:280

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/916-54-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

              Download

            • memory/916-55-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

              Download

            • memory/2012-56-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

              Filesize

              8KB

              Download