Analysis

  • max time kernel
    142s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 13:01

General

  • Target

    ab16b3f14fa03f6fe1d05fe598aa92d4463e5f0cba18807ce668740a6b6a52aa.exe

  • Size

    227KB

  • MD5

    624f7709b3ffe6bd03facf3e0af9d751

  • SHA1

    8f90f8ab6af4f861dc2e65e3650ec41727285b68

  • SHA256

    ab16b3f14fa03f6fe1d05fe598aa92d4463e5f0cba18807ce668740a6b6a52aa

  • SHA512

    0a1bf6f92012ea247e76a5403c5605f01a2fa9a636dcef4f204bfd24a9aa4c987e4580c707bb45896f4401e2e400200e8517e3d961bc45ad3b2b2c6058f7fc15

  • SSDEEP

    6144:U4lwZ40243s0gJvyTZaPYZeHF/tIzi+Tk98i9goc8VRtDkY7:7n0d8PJvyQYZelVIziveo/Rt/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab16b3f14fa03f6fe1d05fe598aa92d4463e5f0cba18807ce668740a6b6a52aa.exe
    "C:\Users\Admin\AppData\Local\Temp\ab16b3f14fa03f6fe1d05fe598aa92d4463e5f0cba18807ce668740a6b6a52aa.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfs668.tmp

    Filesize

    344KB

    MD5

    5cfb0f8e32d3b9197bbb972bd374c381

    SHA1

    4c22e0d3b705cc55658af2cde5a62a899f513f90

    SHA256

    72ae74bf4b315a5ff9e1e7ac9a000b9b76df6492a9b1e830686c903b4b0c168a

    SHA512

    5c6c2a526dfc4ccea67a4db844c79e37d1012afa33bb9330d9c1f826ed1335c8c7f2b7bf98cd60a5625433f26a2a6cd48d279e3e32788fd1bf67ec972c9cee45

  • C:\Users\Admin\AppData\Local\Temp\dfs668.tmp

    Filesize

    344KB

    MD5

    5cfb0f8e32d3b9197bbb972bd374c381

    SHA1

    4c22e0d3b705cc55658af2cde5a62a899f513f90

    SHA256

    72ae74bf4b315a5ff9e1e7ac9a000b9b76df6492a9b1e830686c903b4b0c168a

    SHA512

    5c6c2a526dfc4ccea67a4db844c79e37d1012afa33bb9330d9c1f826ed1335c8c7f2b7bf98cd60a5625433f26a2a6cd48d279e3e32788fd1bf67ec972c9cee45

  • memory/4976-132-0x0000000000420000-0x00000000004AB000-memory.dmp

    Filesize

    556KB

  • memory/4976-133-0x0000000001270000-0x0000000001273000-memory.dmp

    Filesize

    12KB

  • memory/4976-136-0x0000000005480000-0x00000000054DC000-memory.dmp

    Filesize

    368KB

  • memory/4976-137-0x0000000005E90000-0x0000000006434000-memory.dmp

    Filesize

    5.6MB

  • memory/4976-138-0x00000000059C0000-0x0000000005A52000-memory.dmp

    Filesize

    584KB

  • memory/4976-139-0x0000000001270000-0x0000000001273000-memory.dmp

    Filesize

    12KB

  • memory/4976-140-0x0000000005980000-0x000000000598A000-memory.dmp

    Filesize

    40KB

  • memory/4976-141-0x0000000009C00000-0x0000000009C66000-memory.dmp

    Filesize

    408KB

  • memory/4976-142-0x000000000EC30000-0x000000000F3D6000-memory.dmp

    Filesize

    7.6MB

  • memory/4976-143-0x0000000000420000-0x00000000004AB000-memory.dmp

    Filesize

    556KB