a22f393576c3c8fa3ade88102fa98dfc93097d15b4c453ef676f6daaefffa592

Analysis

max time kernel
144s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoSettings/Files/Tools/RunFromToken_x64.exe
Size

848KB
MD5

9b95a6b3999d6610af380ef5dc07a673
SHA1

e12233cc7c2c73e2ea7f8cb431d4e6abb4b0fd21
SHA256

cf6305b1065ed0917c1b693d18ed97d74f53b9298438209715d1bbf971b0858d
SHA512

e68cda1767ed7abdcf2b064bedde8fa641ddcf6ca4c48426beddca17ef1090be897cb7e507be9efd038650825370e800f9da88ef6af007b02ff1c772a2cf1f71
SSDEEP

24576:jmOsLUn3rddAUesIF8WDcanhzO4aYfRo4i:j8A3YkIKWD3zO4akod

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1044	RunFromToken_x64.exe
1044	RunFromToken_x64.exe
1044	RunFromToken_x64.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1044	RunFromToken_x64.exe
1044	RunFromToken_x64.exe
1044	RunFromToken_x64.exe

C:\Users\Admin\AppData\Local\Temp\AutoSettings\Files\Tools\RunFromToken_x64.exe
"C:\Users\Admin\AppData\Local\Temp\AutoSettings\Files\Tools\RunFromToken_x64.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...