Analysis

  • max time kernel
    37s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2023, 06:20

General

  • Target

    ff4c0ba836518e65e3d334a09a6a54a9e3acc2be81a58ca1ad6111a10d582ac0.exe

  • Size

    1.3MB

  • MD5

    d676137bb67c8cbad8caa9c9593680b5

  • SHA1

    b2b3b81e9b8b5a092713214e52028b0d9651387a

  • SHA256

    ff4c0ba836518e65e3d334a09a6a54a9e3acc2be81a58ca1ad6111a10d582ac0

  • SHA512

    3897b11c0d3990304867e2fad1a9fd83d27fb2bb4c4e9f82f752520b961af00104b0b96ef8ebff761ce638ee64eb358bbde7c30a717c50b6dbb36ed70a58498a

  • SSDEEP

    12288:53P/aK2vB+8UMAdB8qr0zw9iXQ40AOzDr5YJjsF/5v3ZkHRik87:5/CKABFatr0zAiX90z/F0jsFB3SQkQ

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff4c0ba836518e65e3d334a09a6a54a9e3acc2be81a58ca1ad6111a10d582ac0.exe
    "C:\Users\Admin\AppData\Local\Temp\ff4c0ba836518e65e3d334a09a6a54a9e3acc2be81a58ca1ad6111a10d582ac0.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2180

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2180-0-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB

  • memory/2180-1-0x0000000000950000-0x00000000009B7000-memory.dmp

    Filesize

    412KB

  • memory/2180-6-0x0000000000950000-0x00000000009B7000-memory.dmp

    Filesize

    412KB

  • memory/2180-7-0x0000000000950000-0x00000000009B7000-memory.dmp

    Filesize

    412KB

  • memory/2180-12-0x0000000000400000-0x00000000005F7000-memory.dmp

    Filesize

    2.0MB