Analysis
-
max time kernel
146s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
23-11-2022 15:56
General
-
Target
c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf.exe
-
Size
72KB
-
MD5
05b982046486d42c98fc820630679a8b
-
SHA1
7ca12b75909ee28dabd3c0e270fdf507b718420c
-
SHA256
c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf
-
SHA512
86b87e30d090861816b13a066c1e9d9b4024cdf27789b90849f8368d38ea6e18a725eb770541e77e65d65c795019a1548038e8bad28496589500a97113301f7a
-
SSDEEP
768:bYJg7KWqwGOgvROJBZAFSe4IDELz7kC8pOalg4352ztpmlDe9BWo5:bYhWkODO/HoL0fgrhppnWo5
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf.exe"C:\Users\Admin\AppData\Local\Temp\c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft Jtiklb\Yokqkmw.exe"C:\Program Files (x86)\Microsoft Jtiklb\Yokqkmw.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD505b982046486d42c98fc820630679a8b
SHA17ca12b75909ee28dabd3c0e270fdf507b718420c
SHA256c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf
SHA51286b87e30d090861816b13a066c1e9d9b4024cdf27789b90849f8368d38ea6e18a725eb770541e77e65d65c795019a1548038e8bad28496589500a97113301f7a
-
Filesize
72KB
MD505b982046486d42c98fc820630679a8b
SHA17ca12b75909ee28dabd3c0e270fdf507b718420c
SHA256c8040e9633f5de0d1a74935cee085cc19abf9d7e244a4883d0aa078bedf3e5bf
SHA51286b87e30d090861816b13a066c1e9d9b4024cdf27789b90849f8368d38ea6e18a725eb770541e77e65d65c795019a1548038e8bad28496589500a97113301f7a