Analysis
-
max time kernel
48s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
27/11/2022, 18:17
General
-
Target
393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68.exe
-
Size
296KB
-
MD5
fbb4b4d737142da694d94acb2e127ed8
-
SHA1
e4b665b493972561a39f422aed1189f35fdea800
-
SHA256
393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68
-
SHA512
adbe38ba5896f87c095e60e2121baabd3051d06df31e2cd875f40f32ba9acabd33eecf2c613da897d34afbd811f780efa61caa4abdd5bf6b4d2cb982dc1e01ed
-
SSDEEP
6144:ZssVkGPVXhBt+ghWd7BTw5qIY7mMmFLra7RDO1f2BG:qsxXhBt+sC9TKqIY7mFLra7Rgf2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68.exe"C:\Users\Admin\AppData\Local\Temp\393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svhost.exeC:\Windows\SysWOW64\svhost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
296KB
MD5fbb4b4d737142da694d94acb2e127ed8
SHA1e4b665b493972561a39f422aed1189f35fdea800
SHA256393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68
SHA512adbe38ba5896f87c095e60e2121baabd3051d06df31e2cd875f40f32ba9acabd33eecf2c613da897d34afbd811f780efa61caa4abdd5bf6b4d2cb982dc1e01ed
-
Filesize
296KB
MD5fbb4b4d737142da694d94acb2e127ed8
SHA1e4b665b493972561a39f422aed1189f35fdea800
SHA256393b734b0ad5ebc5041aa33018a86422c5aafc7b681c242467697242994bea68
SHA512adbe38ba5896f87c095e60e2121baabd3051d06df31e2cd875f40f32ba9acabd33eecf2c613da897d34afbd811f780efa61caa4abdd5bf6b4d2cb982dc1e01ed
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB