abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271

Analysis

max time kernel
142s
max time network
178s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe
Size

182KB
MD5

06caa60c5f532dfe18066028164d5be7
SHA1

0fc6c995aceb77f9096e20cb593d98afa6d65711
SHA256

abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271
SHA512

b65f536e932e17b9e62116713c8314f0cf6dfe0677ea65ee207636a16ad886caee18dcec154d5e50c9e69d1e96c7f9efa4c9057b284f9ae3d651279b9706886a
SSDEEP

3072:mvstUKlvJ2+usOKDUcJaCcBBoKxiAga+4WvNc+xiz8TnYvclg6JFa9EGyLQEXmsk:m0tU7bsJ6RBoL4T18bPlLJFbLQI1LiLr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

pid	process
4896	abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe
4896	abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

description pid process

Token: SeDebugPrivilege 4896 abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

description	pid	process
Token: SeDebugPrivilege	4896	abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

pid	process
4896	abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe
4896	abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe

C:\Users\Admin\AppData\Local\Temp\abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe
"C:\Users\Admin\AppData\Local\Temp\abf0a83feff8b5256b890e71fe746a5f838b2768928740c53336449316e39271.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4896

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dfsD249.tmp
Filesize
251KB

MD5
a1bebaea757db992d76e8a5a85e4aabd

SHA1
2ceeeb96fcd6a71d3d0ea2c1d67b891a3abd4ffb

SHA256
80e8d587f59e07b0b5936677c76bb194f048429321f5a57382198015b9f127ae

SHA512
3b6727584b222031b8948a1c1ca480ed20d378d95ffdc351eac4e936516af4304200e162d2a3eec8e2ddb236829e08a2a3269655076530044d6294ae84fd16bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\dfsD249.tmp
Filesize
251KB

MD5
a1bebaea757db992d76e8a5a85e4aabd

SHA1
2ceeeb96fcd6a71d3d0ea2c1d67b891a3abd4ffb

SHA256
80e8d587f59e07b0b5936677c76bb194f048429321f5a57382198015b9f127ae

SHA512
3b6727584b222031b8948a1c1ca480ed20d378d95ffdc351eac4e936516af4304200e162d2a3eec8e2ddb236829e08a2a3269655076530044d6294ae84fd16bb

Download Submit
memory/4896-132-0x0000000000050000-0x00000000000C4000-memory.dmp

Filesize
464KB

Download
memory/4896-133-0x0000000000D60000-0x0000000000D63000-memory.dmp

Filesize
12KB

Download
memory/4896-136-0x0000000005150000-0x0000000005194000-memory.dmp

Filesize
272KB

Download
memory/4896-137-0x00000000059B0000-0x0000000005F54000-memory.dmp

Filesize
5.6MB

Download
memory/4896-138-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/4896-139-0x00000000053E0000-0x00000000053EA000-memory.dmp

Filesize
40KB

Download
memory/4896-140-0x0000000009500000-0x0000000009566000-memory.dmp

Filesize
408KB

Download
memory/4896-141-0x0000000000D60000-0x0000000000D63000-memory.dmp

Filesize
12KB

Download
memory/4896-142-0x000000000E670000-0x000000000EE16000-memory.dmp

Filesize
7.6MB

Download
memory/4896-143-0x0000000000050000-0x00000000000C4000-memory.dmp

Filesize
464KB

Download