Overview

overview

1

Static

static

infected20...01.zip

windows7-x64

1

infected20...01.zip

windows10-2004-x64

1

Resubmissions

27-12-2022 11:46

221227-nxd4msaa6y 3

27-12-2022 02:34

221227-c2xwrshc8z 1

27-12-2022 02:30

221227-cy46nshc8x 1

27-12-2022 02:04

221227-chlpdshc7y 7

Analysis

  • max time kernel
    114s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27-12-2022 02:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    infected2022122701.zip

  • Size

    2.1MB

  • MD5

    08d80d86af9d0c6992e39e8b34d765cc

  • SHA1

    2d42839bc559c4ebb3d85e7f5a64f2c0117be35b

  • SHA256

    d9e1187a68c4f2b528d47e5ca14a7ffbe4805ad214834c6aa1c616e27e6b9e60

  • SHA512

    eeb67fb8755e91fd9a8875181704520da59a6b948c13537b44b6a36d4b1834e8904dce36f3986b16b83015a35d8a8917a94480491bd069e53f889ca01cd95239

  • SSDEEP

    24576:C2Em+bjDRhlnD1bQLrP7s7vnf8hf6CzIPw7qFV9TMAWVXuGum1xM3f/xzuSAUm4s:C2fOjDRrF4hJ6C0Y7qH9TMDXuR/uSOz

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\infected2022122701.zip
    1⤵
      PID:1468
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:1688
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x15c
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:524

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1688-54-0x000007FEFC5A1000-0x000007FEFC5A3000-memory.dmp

        Filesize

        8KB

        Download