8da6ee120b4c46531a4daa180bb5df3964e817407e941c8cc6aeffbab923ef38

Analysis

max time kernel
148s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Serv-U/ServUAdmin.exe
Size

2.5MB
MD5

a1ce91003dab3490819f6c843e47077a
SHA1

a47333bbf7b59ea85a7dff63d0ae0cb5a1e8c21d
SHA256

89bcd46ae90b05d7b95f184b6cacd13e0be815140f92e35e52d3806f5457885c
SHA512

7903007c5e48b98dba4d564b9875cff53bda8d08861b005e194662bcd5d7f8b5a68ad39df4f6d99d81305f539f39234a67568b00adbe920014441cf19651d6f4
SSDEEP

49152:9PwrHFdwu54mXX2MUUKIUFtoaBQriFhV9o1TB5NYUgQAJv8gcZDL:mT5HXXIZHol6Ug4L

Score

1^/10

Malware Config

Signatures

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4636	ServUAdmin.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: 33	4636	ServUAdmin.exe
Token: SeIncBasePriorityPrivilege	4636	ServUAdmin.exe
Token: 33	4636	ServUAdmin.exe
Token: SeIncBasePriorityPrivilege	4636	ServUAdmin.exe
Token: 33	4636	ServUAdmin.exe
Token: SeIncBasePriorityPrivilege	4636	ServUAdmin.exe
Token: SeManageVolumePrivilege	5048	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Serv-U\ServUAdmin.exe
"C:\Users\Admin\AppData\Local\Temp\Serv-U\ServUAdmin.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
046a11ef56226477f0e7e418312f237a

SHA1
15556fdc873f76fbd399a4d0f8fb6bae0a2e5b79

SHA256
ff76513c31b87d521be85a175e96ec8bcbcc6122c1718d8f3f61b957b2f3554a

SHA512
246f51d970afbf4893f4617d4ae7916ce54fb4210f2670b59b8b3c814871a01ba2443d1573f494973e828c34562b9fa06a8a06de0e62efd4887e879c7a2cab5d

Download Submit
memory/4636-8-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-11-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-3-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-4-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-5-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-6-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-2-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/4636-9-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-7-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-10-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-0-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/4636-12-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-13-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-14-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/4636-1-0x0000000000400000-0x0000000000683000-memory.dmp

Filesize
2.5MB

Download
memory/5048-48-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-55-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-31-0x000001C851E50000-0x000001C851E60000-memory.dmp

Filesize
64KB

Download
memory/5048-49-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-50-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-51-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-52-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-53-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-54-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-47-0x000001C85A440000-0x000001C85A441000-memory.dmp

Filesize
4KB

Download
memory/5048-56-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-57-0x000001C85A460000-0x000001C85A461000-memory.dmp

Filesize
4KB

Download
memory/5048-58-0x000001C85A090000-0x000001C85A091000-memory.dmp

Filesize
4KB

Download
memory/5048-59-0x000001C85A080000-0x000001C85A081000-memory.dmp

Filesize
4KB

Download
memory/5048-61-0x000001C85A090000-0x000001C85A091000-memory.dmp

Filesize
4KB

Download
memory/5048-64-0x000001C85A080000-0x000001C85A081000-memory.dmp

Filesize
4KB

Download
memory/5048-67-0x000001C859FC0000-0x000001C859FC1000-memory.dmp

Filesize
4KB

Download
memory/5048-15-0x000001C851D50000-0x000001C851D60000-memory.dmp

Filesize
64KB

Download
memory/5048-79-0x000001C85A1C0000-0x000001C85A1C1000-memory.dmp

Filesize
4KB

Download
memory/5048-81-0x000001C85A1D0000-0x000001C85A1D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads