Analysis
-
max time kernel
598s -
max time network
601s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
10/10/2023, 15:29
Static task
static1
Behavioral task
behavioral1
Sample
3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe
Resource
win10-20230915-en
Behavioral task
behavioral3
Sample
3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe
Resource
win10v2004-20230915-en
General
-
Target
3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe
-
Size
282KB
-
MD5
b02f4fc921150226d12758d8c86e16a4
-
SHA1
70d0ef0ed57b2f9a508cee5b3652060559ca0d67
-
SHA256
3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c
-
SHA512
d98bd244ad460b19e27eb2d76e53c2e84bd050aeaee5fcd3b3f68f9f6d07700441a32168042fde092414b4cb7eb3225a1e5cb3b6b4716ec1fd28bae0ddee676b
-
SSDEEP
3072:Uxhb2bLEmKFMbPvQnYA6PtIGU2fIetblhPp9Oaq+3PLXTFnM3/WJz0VeO6s:U2bL7KaPvQNGlxhPekjFnzzCZ
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe Token: SeDebugPrivilege 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe"C:\Users\Admin\AppData\Local\Temp\3309963bded5870306c80588776bbf779ea00479458e5ff1680626457e74628c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2296
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD50e4286d8d1a8612da0c589f01e2fada4
SHA1ab60d3f714fff07788fff45508b169bc9565822a
SHA256dfbec6d6fdfbd96fc22ddbb75acc0b6ae38e433d19bdb5f8421fbccd4767dda8
SHA51213b28cfa900ad50bb6a106de7168f3de92b302943ece2ace536bd0038d4df76cf5bf31ce637326916465036928fc93800144ae641354baccee26cf8d2b937e1d
-
Filesize
2KB
MD599f170c535ea631644bf137020148f30
SHA1214908e59504763d67d9edadb5b5ee67e0cecca7
SHA25611aec63473891750a1917d2859a57090dc7000ad9918e5e904bbffbaa6ab7673
SHA512e136c4d88494ea53572a33b0c3fb8739d0b54d50400eb0c3028b72c16d45d26a6156373b3cddf080591343c15f836c818b17b2fc7be13af3c087957a48e4d3e4
-
Filesize
2KB
MD53a71436d55fd3247707886adda23c3a4
SHA1f059595d58acf41a466d3f51ecc17b1b42ece8ff
SHA25650e96310375d13d45544cc6efef1d565ceb16bd5e0f5b337ac3dbd9fd2d648fe
SHA512941a8bcabbf54bc0c78182b4fea88e118de3948dd75d9f5bbbd92dc3de7905e854a8d97939f0e254b40fa04a828ccc8c40ccd05181bdb4e3b1c0c8b57cb7401f
-
Filesize
2KB
MD5ee1217633e9d6ee761392f5e0f3c7add
SHA1a2ddebc2f73c6941e5b82fd6aac6d0a1d6c18ed5
SHA25642dc835c6531df7bd16b6179737205555a76439b9357edec35c492e811450f87
SHA51214513e4684406d78a730646238d852cdb81600aaad503cb1ad12435ac2deb7bf89aa31db124dce2dc98c44288f3fbafb04afb505b17a7327d6e0f52601de22bb
-
Filesize
2KB
MD544c8abd78daa0c4ad1a6fc39cb297691
SHA10d111df0eb22565d448cf81a27837598dfc89aad
SHA2561ba547dd6f6c2688249118c56ff56b9e2a9059b871938422b204c1f378ee3fbc
SHA5121b273f986dfab0177262757a911066b636e7270d7361a23130a9ccd8f89b052fdf7fcdd9e4de57ae209fb8a70f6ea4624fdbfec860768a9f91c574ca378a5fd4
-
Filesize
3KB
MD50f23551a0c1c6ba69c47bd4975756d47
SHA1a7e5bfe2eb4e0b76c876ce51b2996fa169f849df
SHA256fbdf8c7de36f48760542193b5f200db70596f9a12077860537e4624e66c14272
SHA512122c1dc3820e657b23b08191c90e925ff400f1acab34b8d29cf5573f8710a63b9bb4b637e1885b6743c84e11249602dbc6177a9d3825bba7e415cd6f61a619d1
-
Filesize
4KB
MD5123ffaddf3b2deb47f6b8b068790e28e
SHA100291356d0d80b19765ad4ae309cc20cad6804d1
SHA25681ea9cf3d33f160d87110db9d4e7d49674be8f45f7b17f21c5549490c21811e6
SHA512427ef798ee6032002dbca8bc691e91f3021b93014bcfa6f85b3157ea94ccd48fe4df91ff7c549d941c303a9a8b63987bf8f269604536d39e5f35db9b5a749f5e
-
Filesize
37B
MD5332c5d73d6073bba7d87dbd2aa88681e
SHA10c98dd9971426b916b053870fe7c93ba02f9fffc
SHA25637470e41f73e3e38638535a094b2387c8a6f4dbd7f194acc175899f5c1b5d5c4
SHA5120ef306ae7607d2bb17accb26818c5101d05437b0f6bc89d9257135c36a9cd6daf9e1ea3594e394df18f0729151b8209780348c7c0d5b84b04422de3b091ff977
-
Filesize
951B
MD5c3770c692eac124d0fcae6a42fee2bd1
SHA129fa78b8707efef4ac2adb5ea8c3a03722af1aaa
SHA256333effc3b4a6fe6742edc240dd2fd4324532b18695326127ce00015d10fc8212
SHA5126a285ab29c89f683a8581777398a63ce7052244a048339f9b3a186d322b490d50300523289c67ca3632af25a8fa97df964c01d3578f4965442310801d7cc24ab
-
Filesize
1KB
MD5ef1cf4d902eccfdca5308c723379f08c
SHA1c79265728ff39c2125f911742adab350cad56393
SHA2565bc577c094b2963df22b696f1d85a4516ff0e334d9102845aa21015ae6feefb7
SHA512178437f440c14d4c83b0f8df1de466a8bfc9a05e28c370750847b5a7193c03a9972b216e64c7f471c3e363b1975c95ba7735e2a4e4a1d61b98e7f2c49c849142
-
Filesize
1KB
MD58a7f2cab823b85b0e99c8a20cdb19d8a
SHA1897041bdd9c5c55a15963d37612cb8001969451b
SHA256887b0142a65219830190127d713a83bc68815f106112909d6e4410e84e20267a
SHA512ed874a49d7de8d8b686935fe6ac7ca7ebbe5d3a6eeff9fd4d79890a387be0fcbd301134e5a2fd27b20e9fca8821616480f773ece6ad5bee7877ea35f38ca2d0c
-
Filesize
1KB
MD5434faf23b8d649e90ede1ad1241bb952
SHA1f292fa52bfc53bc0e3519a098c51cf6ccf08712f
SHA256e931510601965113f2658f6f8c79801376b617aec9f90008d7a5927373b84d15
SHA512e6ebdafd1fb9d72196fdc64aaff23de6c8f3eecf6982f97cafadf70ecf7a79a280a04c0646f7ea949b2d18512a02e8bcd77c28200ed94e272200b8b2c2a02a88