Analysis
-
max time kernel
152s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-11-2022 05:24
General
-
Target
879238b7081e5f50d5ff82eea86037661d8f27b585b164957e119b2340292dc0.exe
-
Size
344KB
-
MD5
3bc87b787d6bdc1da7b68a55008cd590
-
SHA1
c47e77cd0a6fd3661fbc4357009bfbadff4d83e1
-
SHA256
879238b7081e5f50d5ff82eea86037661d8f27b585b164957e119b2340292dc0
-
SHA512
a593926efb08f0ed7b41b00d5a606796867aa7b0b6794b4b30a06fb33bf2713c61818067b8d7329b7550c9d8e15a80302989a6815c4a5b7e1483013c8a73d0a7
-
SSDEEP
6144:/Qqzdcej+W4QU3oGUz9td8KHWfbam2Hrun7v8MyYVKu4lg4ZBer3KBNtcoS:/Q+dc554V/vmX26TByYn4lgTr3KB0oS
Score
8/10
Malware Config
Signatures
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\879238b7081e5f50d5ff82eea86037661d8f27b585b164957e119b2340292dc0.exe"C:\Users\Admin\AppData\Local\Temp\879238b7081e5f50d5ff82eea86037661d8f27b585b164957e119b2340292dc0.exe"1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
-
Filesize
2.1MB