Analysis

  • max time kernel
    142s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 03:54

General

  • Target

    abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

  • Size

    182KB

  • MD5

    06caa60c5f532dfe18066028164d5be7

  • SHA1

    0fc6c995aceb77f9096e20cb593d98afa6d65711

  • SHA256

    abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271

  • SHA512

    b65f536e932e17b9e62116713c8314f0cf6dfe0677ea65ee207636a16ad886caee18dcec154d5e50c9e69d1e96c7f9efa4c9057b284f9ae3d651279b9706886a

  • SSDEEP

    3072:mvstUKlvJ2+usOKDUcJaCcBBoKxiAga+4WvNc+xiz8TnYvclg6JFa9EGyLQEXmsk:m0tU7bsJ6RBoL4T18bPlLJFbLQI1LiLr

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe
    "C:\Users\Admin\AppData\Local\Temp\abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\dfsD249.tmp

    Filesize

    251KB

    MD5

    a1bebaea757db992d76e8a5a85e4aabd

    SHA1

    2ceeeb96fcd6a71d3d0ea2c1d67b891a3abd4ffb

    SHA256

    80e8d587f59e07b0b5936677c76bb194f048429321f5a57382198015b9f127ae

    SHA512

    3b6727584b222031b8948a1c1ca480ed20d378d95ffdc351eac4e936516af4304200e162d2a3eec8e2ddb236829e08a2a3269655076530044d6294ae84fd16bb

  • C:\Users\Admin\AppData\Local\Temp\dfsD249.tmp

    Filesize

    251KB

    MD5

    a1bebaea757db992d76e8a5a85e4aabd

    SHA1

    2ceeeb96fcd6a71d3d0ea2c1d67b891a3abd4ffb

    SHA256

    80e8d587f59e07b0b5936677c76bb194f048429321f5a57382198015b9f127ae

    SHA512

    3b6727584b222031b8948a1c1ca480ed20d378d95ffdc351eac4e936516af4304200e162d2a3eec8e2ddb236829e08a2a3269655076530044d6294ae84fd16bb

  • memory/4896-132-0x0000000000050000-0x00000000000C4000-memory.dmp

    Filesize

    464KB

  • memory/4896-133-0x0000000000D60000-0x0000000000D63000-memory.dmp

    Filesize

    12KB

  • memory/4896-136-0x0000000005150000-0x0000000005194000-memory.dmp

    Filesize

    272KB

  • memory/4896-137-0x00000000059B0000-0x0000000005F54000-memory.dmp

    Filesize

    5.6MB

  • memory/4896-138-0x0000000005400000-0x0000000005492000-memory.dmp

    Filesize

    584KB

  • memory/4896-139-0x00000000053E0000-0x00000000053EA000-memory.dmp

    Filesize

    40KB

  • memory/4896-140-0x0000000009500000-0x0000000009566000-memory.dmp

    Filesize

    408KB

  • memory/4896-141-0x0000000000D60000-0x0000000000D63000-memory.dmp

    Filesize

    12KB

  • memory/4896-142-0x000000000E670000-0x000000000EE16000-memory.dmp

    Filesize

    7.6MB

  • memory/4896-143-0x0000000000050000-0x00000000000C4000-memory.dmp

    Filesize

    464KB