Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
05-12-2022 18:00
General
-
Target
6c386727321f18ccffb7d7d1b9be8dc9aaf22217a2363b519dacbeda51e804ef.exe
-
Size
230KB
-
MD5
895a827d794a9026bbcfdccb81d2d6a1
-
SHA1
722ef2c5c303cc83109b5c6438674d9d223e3322
-
SHA256
6c386727321f18ccffb7d7d1b9be8dc9aaf22217a2363b519dacbeda51e804ef
-
SHA512
82cdea6e7142baa6205322305660f577b33db5c1c09fbaa3239387c6cfb64041e77b38996cf0de5430dca2b3a64d64622d57c7a5beffc1a5fbb48f8224a861c2
-
SSDEEP
6144:rhQmBw69GFQ7NYM4pq/otJ2dP699vVx+xPT3V904:rhQmBw69wA+Mm+otJL9BErP04
Score
7/10
Malware Config
Signatures
-
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\6c386727321f18ccffb7d7d1b9be8dc9aaf22217a2363b519dacbeda51e804ef.exe"C:\Users\Admin\AppData\Local\Temp\6c386727321f18ccffb7d7d1b9be8dc9aaf22217a2363b519dacbeda51e804ef.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
244KB