d00aeec48163482f98f421e461f4a59f5c94c8ff7f9201224c481e92377d3038 | Triage

Analysis

max time kernel
144s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 04:00

Sharing

Report Analysis Logs

General

Target

5275d8f9fdbf810d975fad5840c63a8e.exe
Size

34KB
MD5

5275d8f9fdbf810d975fad5840c63a8e
SHA1

fd2a1fa5e3e8a1276c164877a4381207dce7ed14
SHA256

d00aeec48163482f98f421e461f4a59f5c94c8ff7f9201224c481e92377d3038
SHA512

0dede6edaedaa99d85d14908e5ed973e73542df83699fa82d3df1346b106a7db70bb68df75a453b576c640b570f4f657817e9f0ec3b337624ff536dcfe3affc4
SSDEEP

768:O5hlAZx6OMcrCiX2RiVbSZXXKOa1KoBzD:Nx6OMgCiX2cV+XXKOdCD

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 1 IoCs

pid	Process
5016	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	taskkill.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4928	5275d8f9fdbf810d975fad5840c63a8e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 5016	4928	5275d8f9fdbf810d975fad5840c63a8e.exe	91
PID 4928 wrote to memory of 5016	4928	5275d8f9fdbf810d975fad5840c63a8e.exe	91
PID 4928 wrote to memory of 5016	4928	5275d8f9fdbf810d975fad5840c63a8e.exe	91

C:\Users\Admin\AppData\Local\Temp\5275d8f9fdbf810d975fad5840c63a8e.exe
"C:\Users\Admin\AppData\Local\Temp\5275d8f9fdbf810d975fad5840c63a8e.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im "5275d8f9fdbf810d975fad5840c63a8e.exe"
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4928-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4928-3-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download