Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2023, 21:59
Static task
static1
Behavioral task
behavioral1
Sample
efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe
Resource
win10v2004-20230915-en
General
-
Target
efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe
-
Size
5.1MB
-
MD5
9b83cceb7e2ad5c521812d49ef712b1a
-
SHA1
7e80d3293e6b0b5eb4728f146096157079349606
-
SHA256
efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619
-
SHA512
012f8fb40ef21ce66e557806b2d0de31d4fa849172c8ab70b9e7c03763e2f4ae27d73dd0bfbe7250f0be9e8edb5d899d6c7dad3596eac01b6edb2e6b6ff4c12b
-
SSDEEP
98304:7AGcu1ya1xAJ9y5xPSbH6ZN9RViAzccl1ZXxmH5JBAUZL8:7r845RSbQVidcl1hxCJVQ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3640 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe 4280 efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe"C:\Users\Admin\AppData\Local\Temp\efeeb5e8ec765f7c201b4b119f769bf16120e16bb62df7f754b34e2e2e98b619.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4280
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:1788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD56a02c7b339b90944150bf16ec7927d56
SHA12ea2150521e1a501709c0b2f7af53fecbd5d2735
SHA256f7910400e9e26137b1c8e94452ffe79965539b36948c51d26294edba5b234b13
SHA5120820502cdb307f3ed865f050e8587b188adb837b65705dfeb557b759ca0fc203a78eadeb39380a731cf5784e5f93f0817fe7f347ccd505609851ae92d6b95a99