Analysis

  • max time kernel
    175s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2022, 11:41

General

  • Target

    af4f5bbb7f7c3b6d7f82adb9921052d1ea9f3f87ae9b0d44b2b08f238589e673.exe

  • Size

    391KB

  • MD5

    3db30a84ef38e73bea113552e28e0b1b

  • SHA1

    a5d6271454047210002fb7a5db00993a663b4932

  • SHA256

    af4f5bbb7f7c3b6d7f82adb9921052d1ea9f3f87ae9b0d44b2b08f238589e673

  • SHA512

    90ff1201e7df9ccfca7d60a4fafa4119d51b26b0a0cc1e2872d86f6f0bc9ccdc91697b6a1df2c21e1d2ed7622188eaad49cab9ad33ea361ac8af7140ed56e55a

  • SSDEEP

    6144:kGyw99vtxI7XzzQoRXdla8To8maHHko/9FsHbtR28mI1iYy:g4vt6bXQoRXdlHToQnl9OH2NIS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af4f5bbb7f7c3b6d7f82adb9921052d1ea9f3f87ae9b0d44b2b08f238589e673.exe
    "C:\Users\Admin\AppData\Local\Temp\af4f5bbb7f7c3b6d7f82adb9921052d1ea9f3f87ae9b0d44b2b08f238589e673.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2920

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\gfdD40E.tmp

          Filesize

          264KB

          MD5

          b795e14dcb8b6f9f79c459c033cc5218

          SHA1

          337d7e4d738dcfc54bda89c76857d834b4fc937a

          SHA256

          6f952d44fef31c1ea27ec812a6102dda47529a9c14589ca36e6d27f67565d905

          SHA512

          d93b1d3b5351f97b0af91589378f9b4733efb13510531cdd58936f8bd0bdc4d8ad9a613dea3a023d77e516dca40fe87e729346fd7825e0e30ab71a8dcf665e4f

        • C:\Users\Admin\AppData\Local\Temp\gfdD40E.tmp

          Filesize

          264KB

          MD5

          b795e14dcb8b6f9f79c459c033cc5218

          SHA1

          337d7e4d738dcfc54bda89c76857d834b4fc937a

          SHA256

          6f952d44fef31c1ea27ec812a6102dda47529a9c14589ca36e6d27f67565d905

          SHA512

          d93b1d3b5351f97b0af91589378f9b4733efb13510531cdd58936f8bd0bdc4d8ad9a613dea3a023d77e516dca40fe87e729346fd7825e0e30ab71a8dcf665e4f

        • memory/2920-134-0x0000000005780000-0x00000000057C6000-memory.dmp

          Filesize

          280KB

        • memory/2920-135-0x00000000060A0000-0x0000000006644000-memory.dmp

          Filesize

          5.6MB

        • memory/2920-136-0x00000000059E0000-0x0000000005A72000-memory.dmp

          Filesize

          584KB

        • memory/2920-137-0x0000000005AA0000-0x0000000005AAA000-memory.dmp

          Filesize

          40KB

        • memory/2920-138-0x0000000009B40000-0x0000000009BA6000-memory.dmp

          Filesize

          408KB

        • memory/2920-139-0x000000000BD70000-0x000000000C516000-memory.dmp

          Filesize

          7.6MB