Analysis
-
max time kernel
91s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
06/02/2023, 07:42
General
-
Target
Patch_WinGate_6_2_2_1137_s0cpy.exe
-
Size
25KB
-
MD5
912ba3b3d5867a58f3208fe86163104e
-
SHA1
d3a9dabd2655e179974dfa214d151f912aa1f093
-
SHA256
e5fc2d2b594d2ecce4285490bf0b2076e980a69aa06e8a93905a9fd1335322ae
-
SHA512
e334162e97f85814481da3789713c4cb9c4cade7f4eb69aa0d084b4e5df1adf6e17c920f9d9faa6f606a31cc6bb686173a65d69e17dfb5a7ca548d64a680ff5c
-
SSDEEP
768:5IkG3/TiDHeD6JaYW6cj9c70m3zaRN8Ad1b:5pGPWYqmXm3zaR2Ar
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Patch_WinGate_6_2_2_1137_s0cpy.exe"C:\Users\Admin\AppData\Local\Temp\Patch_WinGate_6_2_2_1137_s0cpy.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3e4 0x3ec1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD57bac2c6f66524cfc55ae91ddf3ece2dd
SHA1afd526ca6629c5a6c851d66a2983099a3007935e
SHA256b10a2f9f733227ec0edb6ed37cb3c8b592b0ae4e4bcedfb650bfc7622ac6aa71
SHA5124f81516e273d02404e41fd54cac8b5fbe87465dc5554f5665e1b9a4107ba9a9ba34a9222a0061836a558d6db198c0774f98b022992c41750ec2a947dd3bce2bb
-
Filesize
108KB
-
Filesize
108KB