Overview

overview

10

Static

static

5ae1bdb1e2...72.exe

windows7-x64

10

5ae1bdb1e2...72.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    195s
  • max time network
    207s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 14:16

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5ae1bdb1e26f55b91de15649f09504939491ea665c7f6a1fe4998543754a4e72.exe

  • Size

    301KB

  • MD5

    bebdb37751c64f1adc2a77ffd9fd18c2

  • SHA1

    1dcb04ddcd5d8fa1f954023359ad3713b8d1c857

  • SHA256

    5ae1bdb1e26f55b91de15649f09504939491ea665c7f6a1fe4998543754a4e72

  • SHA512

    a6ceaf39bdcb8751d7913788b3f80a2e5b8210484d87a3ea3349e94e7acf649c520e2e8b7a551be7e2535da58e214d4dd4eceb1dea57175cc37041504c6c7250

  • SSDEEP

    6144:3jFLDMAYloj1/L8YEAQwgG5hYm/jZOXhaO:3jNDMAzjN4YEAF2fX8O

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5ae1bdb1e26f55b91de15649f09504939491ea665c7f6a1fe4998543754a4e72.exe
    "C:\Users\Admin\AppData\Local\Temp\5ae1bdb1e26f55b91de15649f09504939491ea665c7f6a1fe4998543754a4e72.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:1056

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1056-132-0x00000000008B0000-0x0000000000902000-memory.dmp
                            Filesize

                            328KB

                            Download
                          • memory/1056-133-0x0000000005850000-0x0000000005DF4000-memory.dmp
                            Filesize

                            5MB

                            Download
                          • memory/1056-134-0x0000000005340000-0x00000000053D2000-memory.dmp
                            Filesize

                            584KB

                            Download
                          • memory/1056-135-0x00000000053E0000-0x000000000547C000-memory.dmp
                            Filesize

                            624KB

                            Download