Overview

overview

3

Static

static

0becf48a34...8a.exe

windows7-x64

3

0becf48a34...8a.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    24s
  • max time network
    29s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-10-2022 07:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0becf48a34167fa4aacbd772ec0665e87ed0f9fdab05e4454725ab160578d28a.exe

  • Size

    130KB

  • MD5

    4f5b2823ee627ec0568d687669b5c14f

  • SHA1

    5001cdd19642054bc039328578f8e7761ec50f5f

  • SHA256

    0becf48a34167fa4aacbd772ec0665e87ed0f9fdab05e4454725ab160578d28a

  • SHA512

    6d320e5e802cc5f14b1ca2da67ab78a4e83653a67915ab671daf325497865acd302a4c0ae40f3fdbf0e8547f3f615228c09ab38c5044fe8bbd5e7377262cf5d4

  • SSDEEP

    3072:KGkXu56Mm+GfIsF7P6Mm+GfIsF7QLfVSM+J9xjm16Mm+GfIsF7D:RB3GfI8PB3GfI8Af+9tGB3GfI8D

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0becf48a34167fa4aacbd772ec0665e87ed0f9fdab05e4454725ab160578d28a.exe
    "C:\Users\Admin\AppData\Local\Temp\0becf48a34167fa4aacbd772ec0665e87ed0f9fdab05e4454725ab160578d28a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2860
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
    1⤵
      PID:1424

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2860-132-0x00007FFBE91E0000-0x00007FFBE9C16000-memory.dmp

      Filesize

      10.2MB

      Download