Analysis
-
max time kernel
1s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 07:31
Behavioral task
behavioral1
Sample
49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe
Resource
win10v2004-20231215-en
General
-
Target
49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe
-
Size
1.4MB
-
MD5
e36614455f58a676dbae883550e6f5bd
-
SHA1
25bba6efec294ac6aa44e3440ba2499804a9b422
-
SHA256
49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5
-
SHA512
21f35168bc37faad422e0c53ae44ecf20a10b8233cb34a4acd0de72be2838a3371a5abe07308e8ffb99bc8c70437eec3e597aee623fca081b79dbab372cfdd48
-
SSDEEP
24576:V05uhGZyuA2J20bTlO/WTyWo3LaDuyawx44DSVXT5Xepp:maGU0JRbpOUcLay1E49XT5Xepp
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2024 49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe 2024 49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2024 49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe Token: SeDebugPrivilege 2024 49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe"C:\Users\Admin\AppData\Local\Temp\49c92864b8fbd7ba28da801d0298a029fc832d454c445ba4ced12faddd0f65a5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2024
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5560459e76bd7be4ef3f207ee0605d47a
SHA11b3657645f958fe711d989cbf2b42483d54d16cd
SHA25646ac0a6a6f2ee95eb0b1e083531b14ba3a98a5f4123315d19d923e92525c7cf9
SHA512448aeb1e839b4e1962382e74668c3266b9f2d3a896cc4e64d4bdef26f35748c4ac76fdf938e5695fc4ad756ac251918ad187fb1e905b40010ff91b9492ed5401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdfc4b9cdcd519f922b127401f67cbd6
SHA1491199e695716d53dc40d7cb48a66d90d186c957
SHA25695f832d8259a9861b9dcc51a73d0f253024a7043992b01145814b5e9773da2d4
SHA5124992029e2d4fcee36a8427ca7d8123aaf2a6a2c38a25bb0deef4d3e9a0164a30e4495f2b88002bdeba9a123ddcc832e26f820a2723c1755a695a9c06e4c9cc9e
-
Filesize
19KB
MD5e998f48acbf7fdf666831c9a4020caa8
SHA1de05c0d2ad33c14f3c59728dfe2a790502450c86
SHA256d06984972bb691ea849bc56f3b1055ad377a0944b4bf61e7e3a858599eedb497
SHA512c37d9f5aa429bfcf065a4040c1e599dfed75f63c4914889fb932d95c5bc26114e4ee7295c710746d759f5e2e33419b9687bfa3e0cfc97c7adbe6f589b2723cc0
-
Filesize
1KB
MD57acf8f126f0e6094b05c4c078cd4442e
SHA1a14acdafd6530c6e5c81a513b88893db53ac7bb8
SHA256af57b6069953416469d3b2410d08aa28e8b1745035328dd1d0efa1f53f4487a4
SHA5125d796b4431891eb90311101f53b4785d81755001453512394d912833cba34046e09776b263ea2a9969aba8060619dd6c2f707e9f75a51f007166d27563e2dbab