fd6a275c7f2653cd48de8747df43ef27b982ec593ef91111e99c2c7428b81150

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
26/11/2023, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4194efb43c649c35402c655aa5b68650.exe
Size

56KB
MD5

4194efb43c649c35402c655aa5b68650
SHA1

0a934f2740856f328e842f4ae504df5b89fe07b8
SHA256

fd6a275c7f2653cd48de8747df43ef27b982ec593ef91111e99c2c7428b81150
SHA512

c3d3c743dbd272b2f1c2092bbbb121683631b02502fec2d91a19f3a3b97f0004fa51f7c49f0d3eaa44befc4d4d48f607e16f61849682537f480457be0f18d5a6
SSDEEP

768:buNZKMI4rD95SacCkVCykJSCEEB7uJBuFayjK9lPSRiTxoX:qf5jSacZCykcCEEBCJBFySEEoX

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1080	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2076	4194efb43c649c35402c655aa5b68650.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 1080	2076	4194efb43c649c35402c655aa5b68650.exe	28
PID 2076 wrote to memory of 1080	2076	4194efb43c649c35402c655aa5b68650.exe	28
PID 2076 wrote to memory of 1080	2076	4194efb43c649c35402c655aa5b68650.exe	28
PID 2076 wrote to memory of 1080	2076	4194efb43c649c35402c655aa5b68650.exe	28

C:\Users\Admin\AppData\Local\Temp\4194efb43c649c35402c655aa5b68650.exe
"C:\Users\Admin\AppData\Local\Temp\4194efb43c649c35402c655aa5b68650.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4194EF~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads