Analysis
-
max time kernel
144s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
07-11-2023 14:15
General
-
Target
MethodPlugin/Microsoft.Extensions.DependencyInjection.Abstractions.dll
-
Size
35KB
-
MD5
1bc1277126655b767aa9e4cbc41bb5e6
-
SHA1
5e46b938639a28651bd4de8eda438ccc5a212e1c
-
SHA256
175dd59c6ef443c8350f5365db3ac262a2f72016d38e1abb304538dacbbe0918
-
SHA512
93c73ecbbbef595af6168457f0805b0b53d40cc126ce33efaa2a65b86d92c27e1b0d3a468f3619bbec70c990601c6d94c8556083cb33e85011c709d4162d665e
-
SSDEEP
384:23VVPJrgCcYGJiH4Dw/lbfQV460lER0+YUMiwEzITzW4PLWGaQHRN7Ot5ltV:CbPRgC4iHt9IVTBYMwEzIpJLOt7
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\MethodPlugin\Microsoft.Extensions.DependencyInjection.Abstractions.dll,#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD5d16b2b8b44325e8ef3dd24e702552ed1
SHA117299bf50a34e5d41b86799461177c3da2382583
SHA2569d9db4d5f416c879ad9e8ba9f1af032f13802280a2149b48e52f93c37d433d1a
SHA512eb88fea416d4e944bbf27913e5cc8af8018bd913541f6f03765f2a4d4747c857373b2d86386cbe1aafeb45860061b5859e1ba921ac6b6f5df06344bb6e4c15ab
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB