Analysis
-
max time kernel
134s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
-
submitted
11/11/2023, 21:17
General
-
Target
my eyes deceive_Data/Managed/System.IO.Compression.dll
-
Size
96KB
-
MD5
bd03377bb478fe581834bb237b4c6725
-
SHA1
c3ae3bcd5c8d9af77cc579e1d335f8cf6d2a2415
-
SHA256
6045d16e65834f67b2604359a137a4b74434293813ccab0d86b34c5f7b1785fa
-
SHA512
7cd60c00a40e4dcb5b4fbcbd71ed2249d0e2baef48aafd2a72cf95040c653187109b85f96167bb8e550d38b630129dd7df597d104e3284a6ade425c480f25501
-
SSDEEP
1536:mVYlTkwzl46ORXHNopHEJo5JK1/E9ITZOBLOTX8MHujjHs67b:mVYZH5460XNopgo5JK1s9NCTXFHuXTP
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\my eyes deceive_Data\Managed\System.IO.Compression.dll",#11⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB