Analysis
-
max time kernel
163s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
29-10-2022 22:41
General
-
Target
519eec9de37cbd636e2331b184dded24a9b3726198286061594d1a211d1947cb.exe
-
Size
264KB
-
MD5
83ab4094df38a5130d22890022b928d0
-
SHA1
f09ed2a274014c4fec572beb18cfe8a878323446
-
SHA256
519eec9de37cbd636e2331b184dded24a9b3726198286061594d1a211d1947cb
-
SHA512
c527aa0ab905bb5957e67b47ede7967c725afe2a97d23123a6f6e78426fd6a5b06e5d2164c541337f98b2973e1cf11a92cbcd84c48160e53603c50015ea80723
-
SSDEEP
6144:0NF1SuuqqTP4d5hoRkwyXbxng8oC3WxM1n0knmES:0X18TOhVfWGtnm
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies WinLogon 2 TTPs 2 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\519eec9de37cbd636e2331b184dded24a9b3726198286061594d1a211d1947cb.exe"C:\Users\Admin\AppData\Local\Temp\519eec9de37cbd636e2331b184dded24a9b3726198286061594d1a211d1947cb.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
300KB
-
Filesize
808KB
-
Filesize
808KB