Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
11-10-2023 06:29
General
-
Target
4515bb7f3f3d5f53b7d5fd8dc51e4647601650afa5bd300de38d99dbdf371aad.exe
-
Size
1.5MB
-
MD5
fe518ef6b516f897d4e20847183c80e9
-
SHA1
74d6392c2c309d89243677f523fa83399f7f6230
-
SHA256
4515bb7f3f3d5f53b7d5fd8dc51e4647601650afa5bd300de38d99dbdf371aad
-
SHA512
ed50134a4da6ba1ecc91c8102235a31e7ecb623852da4fb0ab6b846bffc206be2108fa558c34cc1574e93cd5ac296ec50d2645ab387b6f079d11983ef3250af6
-
SSDEEP
24576:7FE5AmQufUmQteb52zOo5Eo21OZuZCUSO7yZ/TwSfVcYG3K/cJHlnFR+IGNe8j3w:7FE4w5CNWo2IZECTO7yZLNiXicJFFRGN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4515bb7f3f3d5f53b7d5fd8dc51e4647601650afa5bd300de38d99dbdf371aad.exe"C:\Users\Admin\AppData\Local\Temp\4515bb7f3f3d5f53b7d5fd8dc51e4647601650afa5bd300de38d99dbdf371aad.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5cb833665b87d1b03468931aed9067b90
SHA1cae02c31844bdbd971e3e68c134c780d3feb3b31
SHA25644c77e5c81b36fc111677dfa4eec5c560e57eb4c6356103c151b5bccd14225d8
SHA51259354f56cba02ba6f83d500bc548984610a98617845452269f007c853a994aa32ecbbfffb4364d0e023cfeb1de200e6732b7cc963f060dd5516a0d88adcc7c70
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
1.5MB