Analysis
-
max time kernel
152s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07/11/2022, 15:25
General
-
Target
a003c0b85a7c5bc5260d6721ef327bd7286b7cffbd1b55f9177704288d1fe3d7.exe
-
Size
120KB
-
MD5
0c30299f070b98521e26e54d2f57dd47
-
SHA1
1515ff627324d11a33fd3215d8a98b9271706e58
-
SHA256
a003c0b85a7c5bc5260d6721ef327bd7286b7cffbd1b55f9177704288d1fe3d7
-
SHA512
81c4538a683f85e05bb1970a7fedd3ce27079de0b1d13b370a05be45f96e93a15f3a5efe4530b981bd166883a6bfe96eae6a5a39a40d5be6ddd45c58f90d5743
-
SSDEEP
1536:pWGxs9kGdYk8wO4Cnt8RUyho+CHnjXIRXMMGBkyJMjZROYJT3bQghxHCZ:gGfGdYSCnNyho+mnsRcaC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a003c0b85a7c5bc5260d6721ef327bd7286b7cffbd1b55f9177704288d1fe3d7.exe"C:\Users\Admin\AppData\Local\Temp\a003c0b85a7c5bc5260d6721ef327bd7286b7cffbd1b55f9177704288d1fe3d7.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkvtp.exeC:\Windows\SysWOW64\Winkvtp.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD52f8ed7b2446ca2b45d33549ba105ff03
SHA181a1ca359b426582cc1f69db82f61f3c431446c7
SHA2568f58633a2d69e2ab5a642a95d5c3257904cac9643c8174b57a29b9d6c399f451
SHA512c27e9179242bbd95d173ba842e3957afdc066ca9dcc0869ed7db9d3505b9550637775b5cff3788bc9dadb5c641ad64ffa7f492cece9f9adbf8e7775bcaecdd22
-
Filesize
86KB
MD52f8ed7b2446ca2b45d33549ba105ff03
SHA181a1ca359b426582cc1f69db82f61f3c431446c7
SHA2568f58633a2d69e2ab5a642a95d5c3257904cac9643c8174b57a29b9d6c399f451
SHA512c27e9179242bbd95d173ba842e3957afdc066ca9dcc0869ed7db9d3505b9550637775b5cff3788bc9dadb5c641ad64ffa7f492cece9f9adbf8e7775bcaecdd22