Overview

overview

7

Static

static

a7acc973fd...39.exe

windows7-x64

a7acc973fd...39.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    164s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a7acc973fd7e1928c84be2e629576971bf003a5da0842828c7e4791e80917c39.exe

  • Size

    166KB

  • MD5

    055acabfd3989b9ee8efafde63418890

  • SHA1

    2ba3b9634f8aa629006849aae27f76117e803fa4

  • SHA256

    a7acc973fd7e1928c84be2e629576971bf003a5da0842828c7e4791e80917c39

  • SHA512

    915699338939ae3176f2a007c32e051c0fc77a0a81301ee6dbdcd46063dbd82c2a5c7dec150c333afed30345e751a1287db835c5e403c606a2217b5bc69f7d34

  • SSDEEP

    3072:mg1lIh5pAiNfPXeOd9vBaOpwP77UOqlBf0sPq/W:mk2neGBa8w9KcsN

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:600
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p
      1⤵
        PID:772
      • C:\Users\Admin\AppData\Local\Temp\a7acc973fd7e1928c84be2e629576971bf003a5da0842828c7e4791e80917c39.exe
        "C:\Users\Admin\AppData\Local\Temp\a7acc973fd7e1928c84be2e629576971bf003a5da0842828c7e4791e80917c39.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1672

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\31878.001
              Filesize

              132KB

              MD5

              b89a21bf11600e5ee32f2c9ca633a3ec

              SHA1

              1684d508d5099728b8a0079ee301ceb69bccb5a7

              SHA256

              4e1f63a11090a3f5ea612776c44fd5d444082b973aae69219c94d031c0f06070

              SHA512

              48db90d1ef0b3db9cbabca06057f0e9e37a150f39ebd7a0991435157dceb51a3519e83d809df2c3b82c2573c946685631b5101ded633cdd6c5a5641d12077eac

              Download Submit

            • memory/1672-133-0x0000000000400000-0x000000000042D000-memory.dmp

              Filesize

              180KB

              Download