Analysis
-
max time kernel
38s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:21
Static task
static1
Behavioral task
behavioral1
Sample
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe
Resource
win10v2004-20221111-en
General
-
Target
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe
-
Size
639KB
-
MD5
425b386ce36b229a3a37e3c35f24f8ab
-
SHA1
f06f6203eee3368d4e484f2f90f859c7088be6ad
-
SHA256
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d
-
SHA512
d28c587ad96e85101c95561e64f36a76e09b829763799148d97af3d5f4af79c400c07777d740a2c3b5e6dce3d37ce2017d5d783d8d34ba93f0d562e5d9915248
-
SSDEEP
6144:CB9yEFNCJHpwzKCaQcy7Xt5RH71xxc5jE4RyX2z+NzQcRBNnPUEbxakdr0tqzp/y:OoLscYJRxxc5YOwRBNnclcQ0NozXp
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exepid process 1668 e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exedescription pid process Token: SeDebugPrivilege 1668 e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe"C:\Users\Admin\AppData\Local\Temp\e3adf2ff3980baac914e3839cb10ff878bc7228804a655c839d86fae079d935d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1668
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1668-54-0x0000000000A00000-0x0000000000AA8000-memory.dmpFilesize
672KB