aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3

Analysis

max time kernel
152s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3.exe
Size

4.4MB
MD5

ee120ffd8d4eaba697006ea1bd39b47b
SHA1

5787d33ca6610d828bbb1adf32660978692c1468
SHA256

aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3
SHA512

aa3f38d1905790e38e85dc9873fc8aac20028c79de614c5ab2f0c44514d25ffdcd7138d674cf0dfdf09edd063443caa49317c7ed904c824d34d7a1ee68c74fe3
SSDEEP

98304:vSawJQJawIgn1bwz9thuceFfn8D527BWG:qawWJaw9nFwz9tk8VQBWG

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2600	aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3.exe
"C:\Users\Admin\AppData\Local\Temp\aacf3cf83e56d81e9fd0f610b038525e01577f11854478a281289dde4c46d9a3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000140000000-0x0000000140474000-memory.dmp

Filesize
4.5MB

Download
memory/2600-1-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2600-7-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2600-10-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/2600-12-0x0000000140000000-0x0000000140474000-memory.dmp

Filesize
4.5MB

Download