Overview

overview

1

Static

static

1

SharonYarbrough.zip

windows7-x64

1

SharonYarbrough.zip

windows10-2004-x64

1

Resubmissions

24/03/2023, 01:31

230324-bxwx8sdd6v 8

24/03/2023, 01:28

230324-bvm8badd4y 1

Analysis

  • max time kernel
    196s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/03/2023, 01:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SharonYarbrough.zip

  • Size

    6.6MB

  • MD5

    4a07e43c731ee54d5d657c850c922b57

  • SHA1

    3b73fa5b9f0d161336b719daa8aca2576842c140

  • SHA256

    7c5a0ee020e8fb14be5955ee7231191b61f3e077edf638304b046f7d780663bc

  • SHA512

    d786e9c58d43c8d9ff40384c46da0090109cccabfab2b640f85ebe0cabe58aeab24af1dd6fcd40b3fa8add319e26cbd6ea99d86a817a3ce05d759ae8d0d8b367

  • SSDEEP

    98304:nJYK2SkC1ZQ7H+8y7/LD0ruWjt3n0L4zIL5rLfVfwsyIhr3AOABrNcMusgyy+zU7:nJVHKa37Pujt3n0Lx1n2syIWRGMcKV1C

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\SharonYarbrough.zip
    1⤵
      PID:308
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:872
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x588
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1900
      • C:\Windows\system32\notepad.exe
        "C:\Windows\system32\notepad.exe"
        1⤵
          PID:1468

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1468-55-0x00000000002D0000-0x00000000002D1000-memory.dmp

          Filesize

          4KB

          Download