Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
18/05/2023, 16:20
General
-
Target
BenefitsUpdateForm.iso
-
Size
1.1MB
-
MD5
8eb0c4233367b1fd415916a41263f81f
-
SHA1
3f23d42312d2140c7af5deda05176bec9e51d5dc
-
SHA256
2f9730428974811b35ca108e5e35af44de06e10d27d1402d84bd58a5776832dd
-
SHA512
f3e28103f3bbe9771e90f229c150f082fc3d137b8ce7bfd307444423cdf467ecfaaa13e3c4f4302147ef51b5554a51af628f6d54f609addb5380b7839aa0e1d2
-
SSDEEP
384:c0EslCjXlJFh5yhOehmf2DGadc0IXi0aG3S+2FT5dNKF0Oz9PFuDQ1tEmX3:crdh5IBjDGa6FXlwFEFL9PX1X3
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\BenefitsUpdateForm.iso1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken