Analysis

  • max time kernel
    138s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-11-2023 12:52

General

  • Target

    f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe

  • Size

    400KB

  • MD5

    f0de950cca2b38102f771b2d946e04bf

  • SHA1

    d43dbf167920b08ce39743ded126db346f103e13

  • SHA256

    f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c

  • SHA512

    48f1763daaca9c38acc562011a64f2b8e969675ddba51c06826823c3f7c8cc6f9a94815407fc5d81c91fadc4b36761151d83126f865847a8a77840b9a6174a3f

  • SSDEEP

    6144:sP+nER2sX6zWf0G+TP/XXVeXC8X3cO9bOXX3H1:s+GOz1

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe
    "C:\Users\Admin\AppData\Local\Temp\f65c62e5a2bbf0c4d437ea0494c33e50d16ecab95d8b6655b1053dbd5d03e76c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4000

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rg20pg3r.zbf.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/4000-0-0x0000000000DD0000-0x0000000000E38000-memory.dmp

    Filesize

    416KB

  • memory/4000-10-0x00007FF8B4F10000-0x00007FF8B59D1000-memory.dmp

    Filesize

    10.8MB

  • memory/4000-11-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/4000-12-0x000000001C8E0000-0x000000001C902000-memory.dmp

    Filesize

    136KB

  • memory/4000-13-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/4000-14-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/4000-15-0x00007FF8B4F10000-0x00007FF8B59D1000-memory.dmp

    Filesize

    10.8MB

  • memory/4000-16-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/4000-17-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB

  • memory/4000-18-0x0000000002E10000-0x0000000002E20000-memory.dmp

    Filesize

    64KB