Analysis
-
max time kernel
91s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 17:21
Static task
static1
Behavioral task
behavioral1
Sample
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Resource
win7-20220812-en
windows7-x64
1 signatures
150 seconds
General
-
Target
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
-
Size
685KB
-
MD5
bdc4a8ef0f9adbd1253b48aba70167ae
-
SHA1
6b081505de57ec8668ce7b63873510b1f024551a
-
SHA256
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af
-
SHA512
a62c68896d885e0aed2821b26133358b082289151f04f069507f021eb34876e760f1d9ac9a1ffdf03511735845a187a5fd775216b7dedb15eeb2a47efef9e930
-
SSDEEP
12288:5KsrW5aEx8uX+TJ8tXYk4dHct2CAKsw1UBKhm2m+dLPwe4gMSGEj0xLpUk:AsrI8uAXZct2zKtUBKAn+LPwePGV
Malware Config
Signatures
-
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exedescription pid process Token: SeDebugPrivilege 4964 e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exepid process 4964 e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe"C:\Users\Admin\AppData\Local\Temp\e410c4b80aec7d583d1e1fdab7072cc0047aa0ebd433df8a356b57c22ca8d0af.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4964-135-0x000001F17EB50000-0x000001F17EC00000-memory.dmpFilesize
704KB
-
memory/4964-136-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB
-
memory/4964-137-0x000001F17F2C0000-0x000001F17F2C8000-memory.dmpFilesize
32KB
-
memory/4964-138-0x000001F17FC70000-0x000001F17FCA8000-memory.dmpFilesize
224KB
-
memory/4964-139-0x000001F17F2D0000-0x000001F17F2DE000-memory.dmpFilesize
56KB
-
memory/4964-140-0x00007FFCEED30000-0x00007FFCEF7F1000-memory.dmpFilesize
10.8MB