Analysis
-
max time kernel
26s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26-12-2023 00:23
General
-
Target
46241fa1054b7d803c8ce1dd03976990.exe
-
Size
315KB
-
MD5
46241fa1054b7d803c8ce1dd03976990
-
SHA1
adbca2e37c56354c91fc8c4fc53b23c32bac5a73
-
SHA256
f033a6414a233485e972c1705b6ebf9d79bee14f16af8e729761f1c7af7c3b9f
-
SHA512
30ecc8110ced3220fcdecaeab8469e6d2d97c789225e6c0381d483e427c2b90c01700dea6f11b02529903460025dc9200542237e11ff0061ed38459bba2bb4f8
-
SSDEEP
3072:PjxBvj9C3/KMUt02JHabMlTBvj9CJ/KMOov:rLjuJU0CGGxjeJ5v
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\46241fa1054b7d803c8ce1dd03976990.exe"C:\Users\Admin\AppData\Local\Temp\46241fa1054b7d803c8ce1dd03976990.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 23482⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
304KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
392KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
9.6MB
-
Filesize
1024KB