Analysis
-
max time kernel
36s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
04-12-2022 14:44
General
-
Target
f9c4a4fa6ba2c67ad52279a9e893505cc56e64b5a2a73a927f6594fecb9e6776.exe
-
Size
215KB
-
MD5
a0af5b7bad22747023f5be84528831f8
-
SHA1
aac55a0c8b16742a7ac727ec555a32cc0ce84498
-
SHA256
f9c4a4fa6ba2c67ad52279a9e893505cc56e64b5a2a73a927f6594fecb9e6776
-
SHA512
42ba115a0904e001d4979d4c86eadd560e2617e98a3e4d16cdbffbf291ab89ae623c278a4f74c0aad92c5eeb8ad3dc953d645eddcec5d4782c0d6293d58a5180
-
SSDEEP
3072:IQg+9wh2Y6dA8nQdNnGXjyMzNAgQHBstT7c4Xl46kblNtE+OOdGoKgBAfHM0/ymY:IQgI80RQD2AgCFZ68lPE+I9fH
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c4a4fa6ba2c67ad52279a9e893505cc56e64b5a2a73a927f6594fecb9e6776.exe"C:\Users\Admin\AppData\Local\Temp\f9c4a4fa6ba2c67ad52279a9e893505cc56e64b5a2a73a927f6594fecb9e6776.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 360tray.exe /f2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
-
Filesize
264KB