Overview

overview

7

Static

static

d4cf6e631e...4c.exe

windows7-x64

7

d4cf6e631e...4c.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-11-2022 11:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4cf6e631ef1f036fda5b296e32383f83162038465ebcdddc0c7791c53b1ea4c.exe

  • Size

    1.5MB

  • MD5

    d78ecb5cdc71dee4f001eb4287fa4b86

  • SHA1

    b14937222588d1c8742266a8190834946a0f0360

  • SHA256

    d4cf6e631ef1f036fda5b296e32383f83162038465ebcdddc0c7791c53b1ea4c

  • SHA512

    6d55eb5ffc3ef68aa62ab5b4c816037eb5fd23e57b47b425840f5b6203b3bfbeea0666754c01fb1c234c1809509c019a8bce45d23d1fcb15f645a9a83d509c03

  • SSDEEP

    24576:+a1uOCAl0WtnPW+wsDaQw6DDz3qRyPnmGfrnvVUKueY8RmneWtJlq3IVxT:mOC1yPasY6DwOBfrnvV7UeWt/qGd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 3 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4cf6e631ef1f036fda5b296e32383f83162038465ebcdddc0c7791c53b1ea4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d4cf6e631ef1f036fda5b296e32383f83162038465ebcdddc0c7791c53b1ea4c.exe"
    1⤵
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1u32pw4q.npj\7z.dll
    Filesize

    893KB

    MD5

    04ad4b80880b32c94be8d0886482c774

    SHA1

    344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

    SHA256

    a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

    SHA512

    3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1u32pw4q.npj\7z.dll
    Filesize

    893KB

    MD5

    04ad4b80880b32c94be8d0886482c774

    SHA1

    344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

    SHA256

    a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

    SHA512

    3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1u32pw4q.npj\7z.dll
    Filesize

    893KB

    MD5

    04ad4b80880b32c94be8d0886482c774

    SHA1

    344faf61c3eb76f4a2fb6452e83ed16c9cce73e0

    SHA256

    a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338

    SHA512

    3e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb

    Download Submit

  • memory/4216-132-0x0000000074FF0000-0x00000000755A1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4216-136-0x0000000074FF0000-0x00000000755A1000-memory.dmp

    Filesize

    5.7MB

    Download