Analysis
-
max time kernel
47s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
07/11/2022, 04:20
General
-
Target
7c68c919453299d9e8506d87772c6d8aabc259ae6ca8744065d2ef5cd9211bd6.exe
-
Size
915KB
-
MD5
06c40684a399acd092fa9de536f86a36
-
SHA1
5efac3d45e2792af0d63d7e104d743fa57224ef8
-
SHA256
7c68c919453299d9e8506d87772c6d8aabc259ae6ca8744065d2ef5cd9211bd6
-
SHA512
0fabb7d7eeb201a06eff01b0b3e758d0028de2676d285f31b0e62369a84c32e89499f054c50aa8177dd86c5b7da53fb8c0f3fac47e820ab0456157f79b361b4c
-
SSDEEP
24576:6XfYb8tZTzsebE4Jbcv25VnEtcKiCeqia:6vYststv25VnEtECeqv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c68c919453299d9e8506d87772c6d8aabc259ae6ca8744065d2ef5cd9211bd6.exe"C:\Users\Admin\AppData\Local\Temp\7c68c919453299d9e8506d87772c6d8aabc259ae6ca8744065d2ef5cd9211bd6.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
148KB