Analysis
-
max time kernel
79s -
max time network
83s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
-
submitted
26-06-2023 19:38
Errors
Reason
Machine shutdown
General
-
Target
dd017107d4944c12816ab8c5c6b72dd6027515396b8314a61b68a89322694f45.exe
-
Size
1.2MB
-
MD5
17cc34547521567ad2a9201f02f3ddbe
-
SHA1
bfb8e2960f8b20005a0a80ecb081492eb0f2f151
-
SHA256
dd017107d4944c12816ab8c5c6b72dd6027515396b8314a61b68a89322694f45
-
SHA512
11a112bf3a4894467575c58fa05519b2bda2de7e6008d84a7c25a389126e75977b424fe0b8b097c7bdc65d6066fa9f7e929ee1dda8b1fbed34115f121abdc0f9
-
SSDEEP
24576:lahIQ7hfaIWDAZllIyKSz22JU8fpWCoda97g3tHUQfVUv13T3KF:wWQ7hXIyf22NpWCoUN8t0iV0TaF
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd017107d4944c12816ab8c5c6b72dd6027515396b8314a61b68a89322694f45.exe"C:\Users\Admin\AppData\Local\Temp\dd017107d4944c12816ab8c5c6b72dd6027515396b8314a61b68a89322694f45.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB