Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
17-05-2023 01:25
General
-
Target
e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679.exe
-
Size
777KB
-
MD5
a20a4bc58cd0e59aa876521d1b4e3691
-
SHA1
6cfbe4d044dc831656e42586035f8d48b5d5ffdf
-
SHA256
e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679
-
SHA512
fad61eb803b7946cb3258a304d5a4f9a42736dbc3a4933b298f1a9cedbb5af88b39b1ed018d7206d0a427826ce37c63140108454b42c21438c42b2080e5e6589
-
SSDEEP
12288:ZYZfTPUhoX6yPHS0wtek96Akyxo4Xh6vXOsg358UAFLgch6VVCLv:ZGLUWFbKb8AvXoOsS58J07
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679.exe"C:\Users\Admin\AppData\Local\Temp\e2c2908685e1e75ab146191d8757a42fda84c0c0be27f2fd7fe301a8fc0bb679.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
800KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
188KB
-
Filesize
3.3MB
-
Filesize
188KB