Analysis

  • max time kernel
    151s
  • max time network
    172s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 02:02

General

  • Target

    d0ccf811982c6b6533dbe4425a249c6dce6d5981b3bbebdc01d85e262164c575.exe

  • Size

    87KB

  • MD5

    a2dbdae2c4cb701336d4f6be5d2e240d

  • SHA1

    362c692dda1bcf2c29047d76d139b199aa2a9b89

  • SHA256

    d0ccf811982c6b6533dbe4425a249c6dce6d5981b3bbebdc01d85e262164c575

  • SHA512

    c567262c4c6f3b7862a116d92079cd783d65533b7b941edd7ba2216b4bd024bf2979551352bfecd2720f9e11f9d19f8a5499eecbf0a6cc0cfdff3064f9824b7f

  • SSDEEP

    1536:2BaZ43Vc0WVUxOUUvrA1uy1U4G/YpmQdRLEkUdSwgbYPB:+aZ43Vc0WVUxOUF1R1wYpmQdhuB

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0ccf811982c6b6533dbe4425a249c6dce6d5981b3bbebdc01d85e262164c575.exe
    "C:\Users\Admin\AppData\Local\Temp\d0ccf811982c6b6533dbe4425a249c6dce6d5981b3bbebdc01d85e262164c575.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0pkmu0a.hyx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2176-0-0x0000029D91980000-0x0000029D91998000-memory.dmp

    Filesize

    96KB

  • memory/2176-10-0x00007FFAA2B60000-0x00007FFAA3621000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-11-0x0000029DAC030000-0x0000029DAC052000-memory.dmp

    Filesize

    136KB

  • memory/2176-12-0x0000029D93560000-0x0000029D93570000-memory.dmp

    Filesize

    64KB

  • memory/2176-13-0x0000029D93560000-0x0000029D93570000-memory.dmp

    Filesize

    64KB

  • memory/2176-14-0x00007FFAA2B60000-0x00007FFAA3621000-memory.dmp

    Filesize

    10.8MB

  • memory/2176-15-0x0000029D93560000-0x0000029D93570000-memory.dmp

    Filesize

    64KB

  • memory/2176-16-0x0000029D93560000-0x0000029D93570000-memory.dmp

    Filesize

    64KB