Overview

overview

8

Static

static

3

Ph3jbkfngs4g4.exe

windows7-x64

8

Ph3jbkfngs4g4.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    73s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-06-2023 17:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ph3jbkfngs4g4.exe

  • Size

    27.5MB

  • MD5

    8d48f2394d70eaeff9ca06701b8c2b18

  • SHA1

    261cfb922a1386c6f62efaccbc2a8b7f001882e1

  • SHA256

    f703dae8de26aab20688ee0de3a80ead4c09d9a68af17d533b3c75415609f8b8

  • SHA512

    7f1491e82872c7044c39ffd9428ce244aa9e8902b53f4c12ac1d825811df7a7a858c4cc36a9104e62045bdd66a96cdd16842e6848244f6b6ede388d5312e11a2

  • SSDEEP

    786432:asmE846itrumiPiEILhsXZJRHgwLlnaabLtBJGV6:WE84Htm6vLARg+nTbZTM6

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ph3jbkfngs4g4.exe
    "C:\Users\Admin\AppData\Local\Temp\Ph3jbkfngs4g4.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2232-133-0x00000000006B0000-0x0000000002234000-memory.dmp
    Filesize

    27.5MB

    Download
  • memory/2232-134-0x0000000006B90000-0x0000000006C2C000-memory.dmp
    Filesize

    624KB

    Download
  • memory/2232-135-0x00000000071E0000-0x0000000007784000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/2232-136-0x0000000006C30000-0x0000000006CC2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2232-137-0x0000000006A90000-0x0000000006A9A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/2232-138-0x0000000006DC0000-0x0000000006E16000-memory.dmp
    Filesize

    344KB

    Download
  • memory/2232-139-0x0000000006A50000-0x0000000006A60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2232-140-0x000000000A130000-0x000000000A196000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2232-141-0x0000000006A50000-0x0000000006A60000-memory.dmp
    Filesize

    64KB

    Download
  • memory/2232-142-0x0000000006A50000-0x0000000006A60000-memory.dmp
    Filesize

    64KB

    Download