Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
15/11/2023, 13:01
General
-
Target
fb5b6b45d0cea46ae0d474dc339caf149192661f7c30a92fa8c8b6f0c58f7ff1.exe
-
Size
215KB
-
MD5
70602932062ef4df962bdfcd0cba6c7b
-
SHA1
9a89066928bdeec725a15a76b3876690c51ef5ec
-
SHA256
fb5b6b45d0cea46ae0d474dc339caf149192661f7c30a92fa8c8b6f0c58f7ff1
-
SHA512
e567f140ee8fa4f94e09b3d5f031cf785e2dc5b6f27f8dd9fb1058ea7773171f45c136b50a4f884ad9adf990b607ef713fd8965b3f0a54a343830b3f8f65a03e
-
SSDEEP
3072:q46/nP5lBO846S0Wo/E5gTQXdZi8m9+iVtrofsjcGBCLmczWbMa2GnEtQeAg0Fup:vGKd48m9rVtrofz9L9ybmAOiNmGTS
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb5b6b45d0cea46ae0d474dc339caf149192661f7c30a92fa8c8b6f0c58f7ff1.exe"C:\Users\Admin\AppData\Local\Temp\fb5b6b45d0cea46ae0d474dc339caf149192661f7c30a92fa8c8b6f0c58f7ff1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken