Analysis
-
max time kernel
144s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/12/2023, 06:47
General
-
Target
5aa350bd85f95bbb0321095f3d2fabdc.exe
-
Size
33KB
-
MD5
5aa350bd85f95bbb0321095f3d2fabdc
-
SHA1
9cac30e91d5eeda905e3d56cdef28c59a3e59878
-
SHA256
5cd124b10c36fa7bbfe18e90ad56187d1cb728396043821722c464c4d5840c16
-
SHA512
c362fd7986f85f86b1f371b911f38a76c9852cb8db40c5b8f7de7fcdfa4133f6d6c02b1cc97f682e6b0bd93a8beb71970893001298a0cf0193cd072def466081
-
SSDEEP
768:VpPFSsreFWLwvJDAqwm0QBW4XKK+Gp8+LLhakp/ycKJ0anxBY:VpIEowkBWOn8+L44atxnxW
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5aa350bd85f95bbb0321095f3d2fabdc.exe"C:\Users\Admin\AppData\Local\Temp\5aa350bd85f95bbb0321095f3d2fabdc.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵