Analysis
-
max time kernel
280s -
max time network
359s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
30-11-2022 23:48
General
-
Target
a777ee2935835d35e2b48cdf0a81c463738ecfe5451c3668e3ad55e8032e83ed.exe
-
Size
178KB
-
MD5
7ad0092b015841d09e7f22c607c1b976
-
SHA1
bd02c3201404b4fd2132cc92df294edef138b110
-
SHA256
a777ee2935835d35e2b48cdf0a81c463738ecfe5451c3668e3ad55e8032e83ed
-
SHA512
3f5a3bcba8c202c8a00701b011f3768e64cd7ce36f63d83ecc6af968ad4337ee4a570819e22204a5fcdfb111217611cbd301054f1d64d298d9ed46743850000a
-
SSDEEP
3072:R39V8DNGemhyHJMWubSYNw75rs/qbkpkJGfeH3Vs71wBy02Z0WJPfiW:bV8vMWUtgtjJGc6CJ2JyW
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a777ee2935835d35e2b48cdf0a81c463738ecfe5451c3668e3ad55e8032e83ed.exe"C:\Users\Admin\AppData\Local\Temp\a777ee2935835d35e2b48cdf0a81c463738ecfe5451c3668e3ad55e8032e83ed.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB