Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/01/2023, 12:56

General

  • Target

    Test.exe

  • Size

    638KB

  • MD5

    e10a54c88b0055b69165618590583805

  • SHA1

    054742329f83a5d177dd1937992e6755f43c420e

  • SHA256

    a835602db71a42876d0a88cc452cb60001de4875a5e91316da9a74363f481910

  • SHA512

    61ae7b353f8a5cfe8029692a2948b328335225496d564871d4fb5f5637faf9d6f69b14d5d329e3087d9f39dac2b1248d4fd809f91420facc1087e5745dc7f0a7

  • SSDEEP

    12288:+sqQ30A60bYyJxY/qOsc1TNetLiWMV4em8LPd:+sQ5P/qOvN4LexV

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Test.exe
    "C:\Users\Admin\AppData\Local\Temp\Test.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3044

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3044-132-0x0000000000D70000-0x0000000000E16000-memory.dmp

    Filesize

    664KB

  • memory/3044-133-0x0000000005D70000-0x0000000006314000-memory.dmp

    Filesize

    5.6MB

  • memory/3044-134-0x00000000058A0000-0x0000000005932000-memory.dmp

    Filesize

    584KB

  • memory/3044-135-0x0000000005940000-0x00000000059A6000-memory.dmp

    Filesize

    408KB