Analysis
-
max time kernel
36s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
24/04/2023, 07:38
General
-
Target
test-malware.exe
-
Size
5.1MB
-
MD5
f5d0b88484fd1b10e533d6d64b0be134
-
SHA1
3814ddc6be26453a84da9e57cb7720ffddc54fbf
-
SHA256
20e9bcde8a80982952f4207b157c9320d83cadf2b86a9f9154429dcfc9d9e6f7
-
SHA512
d1e7f398aa94bb2994c8d424987fc6cf87f3eba8846677ca7e931833710ace6e7d89cd18c6716b4f77caf1962d5111332ce37b2a16792a98639fae96e8fdd94b
-
SSDEEP
49152:PDsAe4OFmE7doaupfauqcxKF1ely/QfdnbWe4Hrt0lJZ8oQ:BmmIdS13RQ
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\test-malware.exe"C:\Users\Admin\AppData\Local\Temp\test-malware.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAANgA3AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
5.1MB
-
Filesize
512KB
-
Filesize
584KB
-
Filesize
672KB
-
Filesize
1.6MB